Privacy Policy

Last updated: May 2026

🔒 Your privacy is important to us. This policy explains how we collect, use and protect your personal data.

1. Who We Are

Gidavest Ltd ("we", "us", "our") operates the Gidalet platform. We are registered under the Corporate Affairs Commission (CAC) of Nigeria and are committed to protecting the privacy and personal data of all our users.

Data Controller: Gidavest Ltd
Contact: admin@gidalet.com
Address: Abuja, Federal Capital Territory, Nigeria

2. Data We Collect

We collect the following categories of personal data:

Data Type	What We Collect	Purpose
Identity Data	Full name, date of birth, gender	Account creation and verification
Contact Data	Email address, phone number	Communication and notifications
Financial Data	Bank account details, payment history	Processing rent payments and disbursements
Identity Verification	NIN/BVN hash (not the actual number)	KYC compliance and fraud prevention
Device Data	Device type, push notification token	App functionality and notifications
Usage Data	App activity, feature usage	Improving the platform
Property Data	Property address, rental history	Tenancy management

3. How We Protect Your NIN/BVN

🔒 We NEVER store your NIN or BVN. We only store a one-way cryptographic hash that cannot be reversed to reveal your original number.

Your NIN or BVN is used solely for one-time identity verification through our licensed KYC provider (Dojah). Once verification is complete:

Your raw NIN/BVN is immediately discarded
Only a SHA-256 cryptographic hash is stored
The hash cannot be reversed to reveal your original number
This protects you even in the unlikely event of a data breach

4. How We Use Your Data

We use your personal data for the following purposes:

Creating and managing your Gidalet account
Processing rent payments and auto-debits
Verifying your identity as required by Nigerian regulations
Sending important notifications about your tenancy
Calculating and awarding Keys loyalty rewards
Resolving disputes between platform users
Complying with legal and regulatory obligations
Improving our platform and user experience

5. Legal Basis for Processing

We process your personal data under the following legal bases as defined by the Nigeria Data Protection Regulation (NDPR):

Contractual necessity: To fulfill our service agreement with you
Legal obligation: To comply with Nigerian financial regulations and KYC requirements
Legitimate interest: To operate and improve our platform
Consent: For optional features like marketing communications

6. Data Sharing

We share your data only with trusted third parties necessary to provide our services:

Third Party	Purpose	Data Shared
Paystack	Payment processing	Name, email, payment details
Dojah	Identity verification (KYC)	NIN/BVN for one-time verification only
Resend	Email delivery	Name, email address
Supabase	Secure data storage	All platform data (encrypted at rest)

We do not sell your personal data to any third party under any circumstances.

7. Data Retention

We retain your personal data for the following periods:

Active accounts: For the duration of your account
Closed accounts: Up to 7 years for financial records (as required by Nigerian law)
Identity verification hashes: Retained for fraud prevention purposes
Transaction records: 7 years minimum per financial regulations

8. Your Rights

Under the Nigeria Data Protection Regulation (NDPR), you have the following rights:

Right of Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate personal data
Right to Erasure: Request deletion of your data (subject to legal requirements)
Right to Data Portability: Receive your data in a portable format
Right to Object: Object to certain types of processing
Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, contact us at admin@gidalet.com.

9. Data Security

We implement industry-standard security measures to protect your data:

All data is encrypted in transit using TLS/SSL
All data is encrypted at rest in our Supabase database
Access to production data is strictly controlled and logged
Regular security audits are conducted
NIN/BVN is never stored in plain text
Payment data is handled exclusively by PCI-DSS compliant Paystack

10. Cookies and Tracking

The Gidalet mobile app does not use cookies. We collect minimal usage data solely to improve app performance and user experience. We do not use tracking pixels or third-party advertising trackers.

11. Children's Privacy

Gidalet is not intended for users under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately at admin@gidalet.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email and in-app notification at least 30 days before the changes take effect. Your continued use of Gidalet after notification constitutes acceptance of the updated policy.

13. Complaints

If you have concerns about how we handle your personal data, you may:

Contact us directly at admin@gidalet.com
File a complaint with the Nigeria Data Protection Bureau (NDPB) at ndpb.gov.ng

14. Contact Us

For any privacy-related questions or requests:

Email: admin@gidalet.com
Website: gidalet.com
Address: Abuja, Federal Capital Territory, Nigeria