The data controller responsible for your personal data is:

• Entity: ZERODAONE LTD
• Registration: RC 9620327, Corporate Affairs Commission, Nigeria
• Registered office: B85, Full Fledged Estate, Opposite Almukab City, Ring Road Western Bypass, Kano, Kano State 700104, Nigeria
• Marketplace office: A30 Maiduguri Road, Opposite NNPC Depot, Kano, Kano State, Nigeria
• Data protection contact: privacy@zerodaone.com

MyProperties is a product of ZeroDaOne. Where this policy says “we”, “us” or “our”, it means ZERODAONE LTD acting as the data controller for the myproperties.ng platform.

Information you provide

• Account information: Name, email address, phone number, and password when you register.
• Profile information: Bio, location, and avatar when you update your profile.
• Transaction data: Shipping address, payment details (processed by Paystack), and order history.
• Communications: Inquiries, viewing requests, quotes, and messages sent through the platform.
• Partner applications: Business name, specialization, description, and contact details when applying as a vendor.

Information collected automatically

• Device and browser information: IP address, browser type, operating system, and device identifiers.
• Usage data: Pages visited, features used, time spent on pages, and navigation patterns.
• Location data: Approximate location derived from your IP address for region-specific content.
• Cookies: Essential cookies only, for authentication, cart management, and session preferences. See Section 8.

Section 25 of the NDPA requires a lawful basis for every processing activity. Ours are as follows.

Where we rely on legitimate interests, we have considered whether that interest is outweighed by your rights and freedoms. You may object to processing on this basis (see Section 9).

We are transparent about this because you are entitled to know it, and because the answer today is not the answer we want long term.

MyProperties currently runs on infrastructure located in the United Kingdom. Your personal data is therefore transferred outside Nigeria and processed in the UK:

Basis for the transfer

Under Sections 41 to 43 of the NDPA, personal data may be transferred outside Nigeria where the recipient is subject to a legal regime, contract, or binding instrument affording an adequate level of protection. We rely on both of the following:

• The United Kingdom has a comprehensive data protection regime (the UK GDPR and Data Protection Act 2018) which, in our assessment, affords a level of protection comparable in substance to the NDPA.
• Each provider above processes data on our instructions under a written data processing agreement that imposes confidentiality, security, and sub-processor controls.

This is our own assessment of adequacy under Section 41 and does not represent a determination by the Nigeria Data Protection Commission.

Our intention

We intend to migrate this infrastructure to data centres in Nigeria. We have not set a completion date, and we would rather state that plainly than publish a deadline we cannot commit to. We will update this policy when the migration is scheduled, and again when it is complete.

• To provide and maintain our marketplace services.
• To process transactions and send related notifications (order confirmations, shipping updates).
• To facilitate communication between customers and vendors (inquiries, viewings, quotes).
• To verify vendor and partner applications and manage marketplace quality.
• To send service-related emails (password resets, account notifications).
• To improve our platform, fix issues, and develop new features.
• To comply with legal obligations and protect against fraud.

We do not use your personal data for automated decision-making that produces legal effects concerning you, and we do not carry out behavioural profiling for advertising.

We do not sell your personal information. We share it only in these circumstances:

• With vendors: When you send an inquiry, request a viewing, submit a quote, or place an order, the details relevant to that transaction are shared with the vendor so they can fulfil it.
• With our processors: The infrastructure and service providers listed in Sections 4 and 7, each acting on our instructions.
• Where the law requires it: In response to a valid legal obligation, court order, or lawful request from a regulator or law enforcement agency.
• To protect rights and safety: Where necessary to investigate fraud, enforce our Terms, or protect the rights, property, or safety of users or the public.

We do not use analytics, advertising, or behavioural tracking services. If that changes, we will update this policy before deploying them.

We implement technical and organizational measures appropriate to the risk:

• All data in transit is encrypted via HTTPS/TLS.
• Authentication tokens are stored in secure, HttpOnly cookies.
• Passwords are hashed and never stored in plain text.
• Database access is restricted and encrypted in transit.
• Cloudflare provides DDoS protection on our API endpoints.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as Section 40 of the NDPA requires, and we will inform affected users without undue delay.

We use the following essential cookies:

We do not use advertising or tracking cookies. All cookies listed are strictly necessary for the operation of the platform.

We retain your personal data for as long as your account is active, and afterwards only where we have a reason to:

• Account and profile data: Deleted when you close your account, subject to the exceptions below.
• Transaction and payment records: Retained as required by Nigerian tax and company law.
• Fraud and abuse records: Retained as long as necessary to prevent recurrence.
• Records of a dispute: Retained until the dispute is resolved and any limitation period has expired.

As a data subject you have the right to:

• Be informed about how your personal data is processed — this policy.
• Access the personal data we hold about you, and receive a copy of it.
• Have inaccurate or incomplete data corrected.
• Have your data deleted, where we have no overriding legal reason to keep it.
• Restrict processing while a dispute about accuracy or lawfulness is resolved.
• Object to processing carried out on the basis of our legitimate interests.
• Receive your data in a portable, machine-readable format, or have it transmitted to another controller.
• Withdraw consent at any time, where consent is the basis for the processing.
• Not be subject to a decision based solely on automated processing that has legal effects for you.

How to exercise them

Email privacy@zerodaone.com from the address on your account, telling us which right you wish to exercise. We may ask you to confirm your identity before we act, so that we do not disclose your data to somebody else. We will respond within 30 days. If a request is complex and we need longer, we will tell you why within that period. Exercising these rights is free.

If you are not satisfied

You have the right to lodge a complaint with the Nigeria Data Protection Commission, the supervisory authority established under the NDPA, at ndpc.gov.ng. You may complain to the Commission whether or not you have raised the matter with us first, and you may also seek a remedy in court.

Our platform is not intended for children under 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it. If you believe a child has provided us with personal data, contact privacy@zerodaone.com.

We may update this policy from time to time. We will post the updated policy on this page and change the “Last updated” date. Where a change materially affects how we process your data — a new category of data, a new purpose, a new processor, or a new transfer destination — we will notify registered users by email before it takes effect.

For privacy questions or to exercise any of the rights in Section 11:

• Data protection: privacy@zerodaone.com
• General enquiries: info@myproperties.ng
• Phone: +234 703 697 5801, +234 703 399 6669
• Controller: ZERODAONE LTD (RC 9620327), B85, Full Fledged Estate, Opposite Almukab City, Ring Road Western Bypass, Kano, Kano State 700104, Nigeria