Privacy Policy

Hoomefynda is operated by TODO: registered CAC entity name (RC TODO: RC number), of TODO: registered office address. For the personal data described in this policy, we are the data controller under the Nigeria Data Protection Act 2023 (the “NDPA”).

For anything relating to your data — a question, a request, or a complaint — contact us at support@hoomefynda.com.

This policy covers the personal data we handle when you use Hoomefynda, whether you are browsing without an account, signed in as a renter or buyer, or listing a property.

It does not cover what a lister or agent does with your details after we introduce you to them. Once you reveal a lister’s contact details and we pass on yours, that lister handles your data as their own controller, under their own obligations. Nor does it cover other websites we link to.

Account data

Your name, email address and phone number; and, if you choose to add them, your profile photo, gender and address. If you set a password we store only a cryptographic hash of it, never the password itself.

Verification data

One-time codes we send to your email or phone to sign you in, together with whether and when each was used. Codes are short-lived.

Agent and lister data

If you list on Hoomefynda or work as one of our agents: your public profile (biography, photo, territory, specialisations), your verification status, and the properties assigned to you. Agents acting for an owner who is not on the platform also record that owner’s name and phone number. Those owner details are private to the agent and are never shown to renters.

Listing content

Property details, descriptions, pricing and photographs you upload. Published listings are public and are indexed by search engines.

Contact requests

When you reveal a lister’s contact details, we record your name, phone number, email address if you gave one, any message you sent, which property it concerned, which method you used, and when. This is the record of the introduction, and it is shared with the lister.

Activity data

The properties you favourite, the searches you save, and the listings you report. Reports can also be submitted without signing in.

Preferences

Your notification settings (new properties, price drops, weekly digest) and your language preference.

Technical data

Your IP address, browser and device type, and server log data generated as you use the platform, including data used to enforce rate limits and detect abuse. See our Cookie Policy for what we store in your browser.

We count how many people view each listing. If you are not signed in, we count the view using a one-way hash of your IP address and browser details that changes every day; we set no cookie for this. If you are signed in, the view is stored with your account, once per listing per day. We use view data only for view counts and “popular” rankings. Views of a listing by its own lister and by admins are not counted.

• Directly from you — when you create an account, complete your profile, publish a listing, contact a lister, or email us.
• Automatically — technical and activity data generated as you use the platform.
• From Google — if you sign in with Google, we receive your name, email address and profile picture from your Google account. We do not receive your Google password.

Section 25 of the NDPA requires a lawful basis for each purpose. Ours are:

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You can object to that processing — see your rights below.

With listers, when you ask us to

This is the most consequential sharing we do, so we want it clear: when you reveal a lister’s contact details, we give that lister your name and phone number, your email address if you provided one, and any message you sent, along with which property you enquired about. We do this so they can reply to you. It is the point of the platform, and it cannot be undone once it has happened.

What other users can see

If you publish a listing, your listing content is public. If you are one of our agents, your public profile is visible to anyone. Your email address, phone number and saved activity are never shown publicly.

Service providers

We use the following processors, each handling data only on our instructions and only for the purpose shown:

Others

We may disclose personal data to law enforcement, regulators or courts where we are legally required to, or where it is necessary to establish or defend legal claims or to protect someone’s safety. If our business is sold or reorganised, data may transfer to the acquirer under the same protections.

We do not sell your personal data, and we do not share it with advertising networks.

Some of the providers listed above store or process data outside Nigeria. Where that happens, we transfer the data under Part VIII of the NDPA — either to a country the Nigeria Data Protection Commission (NDPC) recognises as providing adequate protection, or under contractual safeguards that require the provider to protect it to an equivalent standard. You can ask us for details of the safeguards that apply to a particular transfer.

We keep personal data for as long as we need it for the purpose we collected it, and then delete or anonymise it.

• Active accounts — for as long as your account is open.
• Deactivated accounts — your data is retained so you can reactivate. Ask us to delete it permanently and we will, subject to the exceptions below.
• One-time codes — minutes; they expire quickly by design.
• Contact requests — retained as the record of an introduction, so that both sides have a record and so we can investigate disputes and fraud.
• Reports about listings — retained after the reporter’s account is deleted, but detached from them so they are no longer attributable to you. Deleting a report along with its author would let a bad actor erase the evidence against them.
• Logs and security data — a short period, then deleted.

We may keep data longer where the law requires it, or where it is needed for a legal claim that is under way.

You have the right to:

• Access — ask what personal data we hold about you and get a copy.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data, where we have no overriding reason to keep it.
• Restriction — ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect processing that already happened.
• Complain — lodge a complaint with the supervisory authority.

Exercising these rights is free, and we will respond within the period the NDPA requires. We may need to verify your identity first.

Many of these you can do yourself, immediately:

• Correct your name, email, phone and profile details in your account settings.
• Turn marketing and alert emails on or off in your settings.
• Deactivate your account from your settings.

For anything else — a copy of your data, permanent deletion, an objection, or a portability request — email support@hoomefynda.com and tell us what you need.

We use technical and organisational measures appropriate to the risk: encryption in transit, hashed passwords, access controls limiting staff access to what their role requires, rate limiting and abuse detection, and vetted service providers bound by contract.

No system is completely secure. You can help by keeping your one-time codes private, never sharing your account, and telling us promptly at support@hoomefynda.com if you think something is wrong. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the Nigeria Data Protection Commission (NDPC) as the NDPA requires.

Hoomefynda is not for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact support@hoomefynda.com and we will delete it.

We use a small number of cookies, and today they are all strictly necessary to sign you in and keep the platform secure. Our Cookie Policy names each one and explains how to manage them.

We will update this policy as the platform changes or the law requires. The “last updated” date at the top always reflects the current version, and we will give you notice of significant changes in the app or by email.

TODO: registered CAC entity name (RC TODO: RC number)
TODO: registered office address
support@hoomefynda.com

Please come to us first — we would rather fix a problem than have you escalate it. But you always have the right to complain directly to the Nigeria Data Protection Commission (NDPC), whose contact details are at ndpc.gov.ng.