Privacy Policy

Casafrique ("Casafrique," "we," "us," or "our") is operated by [Legal Entity Name, e.g. Casafrique Properties Limited], a company registered in Nigeria with RC number [RC Number], with its registered office at [Registered Address].

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when you visit our website, submit an acquisition brief, complete identity verification (KYC), or otherwise interact with our services. It is issued in accordance with the Nigeria Data Protection Act, 2023 ("NDPA") and the regulations of the Nigeria Data Protection Commission ("NDPC").

Where you access our services from outside Nigeria, we additionally apply safeguards consistent with internationally recognized data protection standards, including the EU General Data Protection Regulation ("GDPR"), where applicable.

By submitting your information through our acquisition brief form or engaging our services, you acknowledge that you have read and understood this Policy.

We collect the following categories of personal data:

a) Information you provide directly

• Full name, email address, and phone number (Acquisition Brief form)
• Location of interest, budget range, and property type preferences
• Additional notes or free-text information you choose to share
• How you heard about us (marketing attribution — optional and used only in aggregate)

b) Identity Verification (KYC) data

Where you proceed to our verification process as a buyer or seller, we (directly or through a licensed third-party KYC provider, see Section 6) collect:

• Government-issued identification (e.g. NIN, international passport, driver's licence)
• Proof of address documentation
• Source-of-funds declarations, where required for high-value transactions
• Selfie or liveness-check biometric data, where the verification provider requires it

KYC data is classified as sensitive personal data under the NDPA and is processed under stricter safeguards described in Section 7.

c) Information collected automatically

• IP address, browser type, device identifiers, and operating system
• Pages visited, time spent, referral source, and general usage analytics
• Cookies and similar tracking technologies (see Section 9)

d) Information from third parties

We may receive information about you from real estate partners, legal counsel, escrow agents, or referring members of our network, where you have been introduced to us in connection with a property transaction.

We process personal data only for specified, legitimate purposes, including to:

• Evaluate and respond to your acquisition brief and match you to relevant properties
• Verify your identity and eligibility to transact, in line with anti-fraud and anti-money-laundering obligations
• Coordinate transaction logistics with legal, escrow, surveying, and developer partners on your behalf
• Communicate with you regarding your enquiry, transaction status, or account
• Maintain internal records for compliance, audit, and dispute-resolution purposes
• Improve our website, services, and matching accuracy through aggregated analytics
• Comply with applicable legal, regulatory, or law-enforcement obligations

We do not use your personal data for automated decision-making that produces legal effects concerning you without human review, and we do not sell your personal data to third parties.

Under the NDPA, we rely on the following lawful bases:

• Consent — for marketing communications and non-essential cookies, which you may withdraw at any time
• Contractual necessity — to process your brief and facilitate a property transaction you have requested
• Legal obligation — for KYC, anti-money-laundering, and tax-reporting requirements
• Legitimate interest — for fraud prevention, platform security, and service improvement, balanced against your right to privacy

We disclose personal data only where necessary, and only to parties bound by confidentiality and data protection obligations equivalent to this Policy:

• Verified sellers/developers — limited to the information necessary to assess your brief, and only after you have completed identity verification
• Legal counsel, escrow agents, and licensed surveyors engaged to execute a transaction you have initiated
• Third-party KYC/identity verification providers — see Section 6
• Service providers such as hosting infrastructure, email delivery, and analytics providers, under data processing agreements
• Regulators or law enforcement, where legally compelled

We do not transfer personal data outside Nigeria except where the recipient jurisdiction provides an adequate level of protection, or appropriate safeguards (such as standard contractual clauses) are in place, in compliance with NDPA cross-border transfer requirements.

Identity verification is conducted [in-house / via [Provider Name, e.g. Smile Identity, Youverify, etc.]]. These providers process your identification documents and biometric data under their own privacy and security obligations, and act as independent data controllers or processors as applicable. We recommend reviewing their respective privacy policies, available at [Provider Privacy Policy URL].

Where KYC requires biometric or sensitive financial data, we apply heightened safeguards, including:

• Encryption in transit (TLS 1.2+) and at rest
• Access restricted to personnel on a strict need-to-know basis
• Storage isolated from general marketing or analytics data
• Retention limited strictly to the period described in Section 8

We obtain your explicit consent prior to collecting sensitive personal data, and you may decline — though this will prevent us from progressing your transaction past the brief stage.

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Policy:

• Acquisition brief data (no transaction proceeds): retained for [e.g. 24 months], then deleted or anonymized
• KYC/identity documents: retained for [e.g. 5–7 years] post-transaction, in line with AML record-keeping obligations
• Transaction records: retained per statutory limitation periods under Nigerian law
• Marketing consent records: retained until consent is withdrawn, then logged for compliance evidence only

You may request earlier deletion under Section 10, subject to our overriding legal retention obligations.

We use cookies and similar technologies to:

• Essential cookies — required for site functionality (cannot be disabled)
• Analytics cookies — to understand site usage (e.g. [Google Analytics / Plausible / etc.])
• Marketing cookies — only with your consent, to measure campaign effectiveness

You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling non-essential cookies does not affect your ability to submit an acquisition brief.

Under the NDPA, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion, subject to legal retention obligations
• Restriction — limit how we process your data in certain circumstances
• Objection — object to processing based on legitimate interest or for direct marketing
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent — at any time, where processing is consent-based
• Lodge a complaint — with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, contact our Data Protection Officer using the details in Section 13. We will respond within the statutory timeframe (generally within one month).

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the data we process, including encryption in transit and at rest, role-based access controls, regular security reviews, and contractual data protection obligations imposed on all third-party processors.

No system is completely secure. In the event of a data breach likely to result in a risk to your rights, we will notify the NDPC and affected individuals in accordance with NDPA breach-notification timelines.

Our services are intended for individuals aged 18 and above. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.

For privacy-related enquiries, complaints, or to exercise your rights, contact:

Data Protection Officer
Casafrique
Email: [dpo@casafrique.com]
Phone: [+234 XXX XXX XXXX]
Address: [Registered Business Address]

You may also contact the Nigeria Data Protection Commission at www.ndpc.gov.ng if you believe your rights have been violated.

We may update this Policy periodically to reflect changes in our practices or legal requirements. Material changes will be communicated via the website or, where appropriate, by direct notice. The "Last Updated" date below reflects the most recent revision.