Privacy Policy

1. Who We Are

Alcarza Technologies Ltd is the data controller for personal data processed through the Platform. We are based in Lagos, Nigeria, and operate under the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023.

For questions about this policy or to exercise your rights, contact our Data Protection Officer at privacy@alcarza.com.

2. Data We Collect

We collect the following categories of personal data:

Account and Identity Data

• Full name, email address, phone number, and date of birth (to verify you are 18 or older).
• Profile photo (optional).
• For hosts: government-issued ID documents submitted for identity verification, and Nigerian bank account details for payouts.

Booking and Transaction Data

• Booking history, check-in and check-out dates, property details, and booking status.
• Payment references and transaction IDs provided by Paystack. We do not store card numbers, CVVs, or full card details — these are processed and held by Paystack.

Device and Technical Data

• Device push notification tokens (to send booking updates and alerts).
• IP address and user agent string, captured on login and security-relevant events for fraud prevention and account security.
• App version, operating system, and device type.

Location Data

• Your approximate location, if you grant permission, to show nearby properties. You can skip this step or revoke permission at any time in your device settings.

Content You Submit

• Reviews, messages, and photos you upload to the Platform.

3. How We Use Your Data

We process your personal data for the following purposes and on the following lawful bases:

4. Sharing Your Data

We share your personal data only as necessary:

• Paystack — our payment processor. When you make a payment, your card details are submitted directly to Paystack under their own privacy policy. We receive only a payment reference and transaction status.
• SendGrid — our transactional email provider. We share your email address and booking details to deliver confirmation and notification emails.
• Expo Push Notification Infrastructure — we share your device push token with Expo's push service to deliver in-app notifications about bookings and messages.
• Hosts — when you make a booking, we share your name and contact details with the host to facilitate your stay.
• Law enforcement and regulators — where required by applicable law or a valid legal process.

We do not sell your personal data to third parties.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Platform's services. After account deletion, we retain certain data for up to 7 years to comply with Nigerian tax and financial record-keeping obligations, and to resolve disputes or enforce our agreements.

Security event logs (including IP addresses and user agents) are retained for up to 12 months.

6. Your Rights

Under the NDPR and, where applicable, the GDPR (for users in the European Economic Area or United Kingdom), you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request that we delete your personal data, subject to legal retention obligations.
• Objection — object to processing based on legitimate interests.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email privacy@alcarza.com. We will respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local supervisory authority.

7. Children

The Platform is not intended for anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@alcarza.com and we will delete it promptly.

8. Cookies and Local Storage

Our website uses cookies and local storage to maintain your session, remember your preferences, and analyse usage. You can control cookies through your browser settings. Disabling cookies may affect some functionality of the web platform.

Our mobile applications use device local storage to cache session tokens and user preferences. This data stays on your device and is cleared when you log out or uninstall the app.

9. International Transfers

Your data may be processed outside Nigeria by our service providers (including Paystack, SendGrid, and Expo). Where such transfers occur, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, consistent with NDPR requirements.

10. Security

We implement technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (TLS), access controls, and security event monitoring. No system is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date and, for material changes, notify you via the app or email. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

12. Contact and DPO

For privacy enquiries or to exercise your rights: