Privacy Policy

Realestway (“we”, “us”, or “our”) is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us by property seekers, tenants, buyers, real estate agents, property managers, and website visitors.

This Privacy Policy is formulated in strict compliance with the Nigeria Data Protection Act (NDPA) 2023 and guidelines established by the Nigeria Data Protection Commission (NDPC). It explains how we collect, process, store, disclose, and protect personal data when you access our web and mobile applications.

Under the Nigeria Data Protection Act (NDPA) 2023, government identifiers such as the National Identification Number (NIN) are treated as Sensitive Personal Data requiring heightened technical and organizational safeguards:

• Strict Purpose Limitation: Agent NINs are collected solely to authenticate identity, prevent property fraud, and maintain verified marketplace standards.

• Cryptographic Protection: NIN data in transit is encrypted using TLS 1.3 encryption. At rest, identity credentials are encrypted using industry-standard AES-256 encryption.

• PII Masking: NINs are never displayed in full on public profiles, public databases, or employee admin interfaces. Internal review tools utilize automated Personally Identifiable Information (PII) masking.

• Zero Commercialization: We never sell, lease, rent, or share agent identity numbers with third-party marketers or advertisers under any circumstances.

Under Section 25 of the NDPA 2023, we process personal data only when an authorized legal basis applies:

• Contractual Necessity: To deliver the services you request, including managing your user account, publishing listings, connecting you with agents, routing WhatsApp inquiries, and provisioning Pro subscription benefits.

• Explicit Consent: Where you have granted unambiguous permission, such as providing your device location to find nearby properties or subscribing to marketing newsletters.

• Legal & Regulatory Obligation: To comply with applicable Nigerian statutory obligations, including tax recordkeeping, anti-money laundering (AML) controls, and lawful court directives.

• Legitimate Interests: To detect and prevent fraudulent listings, protect platform security against malicious bots or scraping, and optimize property discovery algorithms.

We use the collected information for the following operational purposes:

• Facilitating direct real-time connections between seekers and verified property agents.

• Processing one-time SMS or WhatsApp One-Time Passwords (OTPs) for phone number verification.

• Managing agent Pro subscriptions, featured listing rankings, and renewal notifications.

• Generating anonymized market trend reports and rental price intelligence across Nigerian urban corridors.

• Investigating reported spam, unauthorized listings, or fraudulent property advertisements.

To provide a seamless property search experience without forcing immediate registration, we assign a pseudonymous device identifier:

• Stores your recent searches, viewed properties, and preferred city filters on your device.

• Calculates aggregate listing view metrics and popularity rankings.

• Does not link to your real-world identity, phone number, or email unless you deliberately create an account.

We disclose personal data strictly in the following limited contexts:

• With Agents & Hosts: When you submit an inquiry or click to contact a listing representative via WhatsApp or telephone.

• With Infrastructure Service Providers: Trusted vendors who provide SMS/OTP dispatch (Termii), payment gateway processing (Paystack), and cloud hosting (Amazon Web Services), bound by confidentiality agreements.

• Compliance with Legal Process: When mandated by a lawful subpoena, search warrant, court order, or written directive from an authorized Nigerian law enforcement or regulatory agency.

• Business Transfers: In the event of a merger, acquisition, or restructuring, where data transfer is necessary for continued service operations subject to this Privacy Policy.

Realestway collaborates with reputable technology partners to deliver our services:

• Payment Processing: Paystack Payments Limited (CBN-licensed, PCI-DSS compliant payment gateway).

• SMS & WhatsApp Messaging: Termii Limited (telecom messaging provider for OTP verification).

• Authentication: Google OAuth for single-sign-on (SSO) login.

• Analytics: Google Analytics and Google Tag Manager for aggregated, anonymous web traffic measurement.

These service providers are prohibited from using your personal data for any purpose other than providing services to Realestway.

In accordance with Sections 41–43 of the NDPA 2023 regarding cross-border transfers of personal data:

• Hosting Infrastructure: Realestway utilizes secure cloud infrastructure hosted by Amazon Web Services (AWS) in the European Union (Ireland - eu-west-1 region) and CloudFront global content delivery networks.

• Adequate Safeguards: Cross-border transfers to AWS infrastructure are subject to rigorous international data protection standards, strict encryption, and contractual data processing agreements that ensure data protection levels equivalent to or exceeding NDPA standards.

• Data Security: All data stored outside Nigeria is encrypted at rest (AES-256) and in transit (TLS 1.3).

Realestway employs multi-layered technical, administrative, and physical security measures:

• Encrypted communications via HTTPS/TLS 1.3 across all web and mobile endpoints.

• Database encryption at rest for sensitive credentials and user profiles.

• Role-based access controls (RBAC) ensuring only authorized technical staff have access to internal systems.

• Regular automated security vulnerability assessments and continuous container monitoring.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active User Accounts: Retained for the duration of your active account lifecycle.

• Expired Property Listings: Expired listings are retained for an initial 30-day reactivation window, after which original high-resolution media objects are queued for automated deletion.

• Identity Verification Documents (KYC): Retained for as long as the agent remains accredited on the platform, plus statutory audit requirements.

• Financial & Subscription Records: Transaction logs, invoice references, and payment tokens are retained for six (6) years in compliance with Nigerian tax and corporate recordkeeping regulations.

• Account Deletion: Upon receiving a verified account deletion request, user profiles, telephone records, and saved searches are permanently deleted or irreversibly anonymized within thirty (30) days.

Under the Nigeria Data Protection Act 2023, data subjects possess the following enforceable rights:

• Right of Access: You have the right to request confirmation of whether we process your personal data and obtain a copy of that data.

• Right to Rectification: You have the right to correct or update inaccurate, incomplete, or out-of-date personal information.

• Right to Erasure (“Right to be Forgotten”): You may request the permanent deletion of your personal data where there is no continuing legal basis for its retention.

• Right to Restrict or Object: You may object to or request the restriction of processing for direct marketing or automated profiling.

• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format.

• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting prior lawful processing.

To exercise any of these statutory rights, please submit a written request to privacy@realestway.com. We will respond within thirty (30) days as required by law.

Realestway uses cookies and local browser storage to:

• Maintain authenticated user and agent sessions.

• Store user interface preferences (e.g. recent searches, favorite properties).

• Analyze portal traffic and performance metrics.

You can configure your browser settings to reject cookies or notify you when cookies are set. Please note that disabling essential cookies may impact certain platform features (such as staying signed in).

We may periodically update this Privacy Policy to reflect evolving legal frameworks, technological enhancements, or platform modifications. Changes will be published on this page with an updated “Last Updated” date. We encourage you to review this policy periodically.

If you have inquiries, concerns, or requests regarding your personal data or this Privacy Policy, please reach out to our dedicated privacy desk:

Regulatory Redress: If you believe that your privacy rights under the Nigeria Data Protection Act have not been adequately addressed, you have the statutory right under the NDPA to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng or via email at info@ndpc.gov.ng.