Privacy Policy

Listinn Realty ("Listinn", "we", "us") is the data controller for personal data processed through our website, mobile apps, and related services (the Platform). This Privacy Policy is issued under the Nigeria Data Protection Act 2023 (NDPA) and the NDPA General Application and Implementation Directive 2025 (GAID), enforced by the Nigeria Data Protection Commission (NDPC).

Last updated: 26 August 2026

Read together with our Terms of Service and any booking or tenancy agreement.

1. Data controller and contacts

• Privacy requests: privacy@listinn.io
• Data Protection Officer: dpo@listinn.io
• Offices: 16 Olufowobi Lawanson, Surulere, Lagos; 225 Dyer St, 2nd Floor, Providence, RI 02903

2. Regulatory framework

We process personal data in line with the NDPA, the GAID, and NDPC guidance. Where Listinn qualifies as a Data Controller or Data Processor of Major Importance — including where we process personal data of more than 200 data subjects in Nigeria within six months, provide commercial ICT services involving personal data, or process data of particular economic significance — we will:

• Register with the NDPC and keep registration details current
• Designate a Data Protection Officer
• Conduct Data Privacy Impact Assessments for high-risk processing (including biometric KYC and cross-border transfers)
• File Compliance Audit Returns where required for our registration tier
• Notify the NDPC of personal data breaches within 72 hours of becoming aware, where required by law

3. Information we collect

4. How we use your information

• Provide listings, bookings, escrow, and Platform services
• Verify identity and prevent fraud or money laundering
• Personalise recommendations and improve the product
• Communicate service updates and respond to support requests
• Meet legal, tax, AML, regulatory, and dispute-resolution obligations

Legal bases under the NDPA include contract performance, legal obligation, legitimate interests that do not override your rights, and consent where required (including certain marketing and, where applicable, sensitive or biometric KYC processing).

5. Sharing and processors

We may share data with:

• Property agents or counterparties as needed to complete a booking or inquiry
• Processors for payments, KYC, hosting, and analytics under confidentiality and NDPA-aligned contracts
• Professional advisers and competent authorities where required by law

We do not sell personal information.

6. Cross-border transfers

Where personal data is transferred outside Nigeria, we apply NDPA Part VIII safeguards: NDPC adequacy where available, approved transfer instruments (such as standard contractual clauses or binding corporate rules), or another lawful condition under the NDPA/GAID. High-risk transfers are subject to Data Privacy Impact Assessment as required.

7. Retention

We retain personal data for the life of your account and thereafter as required for Nigerian financial, AML, tax, and dispute obligations (typically up to seven years for transactional and audit records). KYC artefacts are kept only as long as needed for verification, fraud prevention, and legal retention, then deleted or irreversibly anonymised.

8. Your rights under the NDPA

Subject to lawful exceptions, you may:

• Be informed about and access your personal data
• Rectify inaccurate data
• Request erasure, restriction, or object to processing
• Request data portability
• Withdraw consent where processing is consent-based
• Be informed of safeguards for transfers outside Nigeria
• Lodge a complaint with the NDPC (ndpc.gov.ng)

To exercise rights, email privacy@listinn.io or dpo@listinn.io.

9. Security and breach notification

We use encryption in transit, access controls, least-privilege administration, logging, and vendor due diligence. No system is perfectly secure.

Where a personal data breach is likely to result in a risk to rights and freedoms, we will notify the NDPC within 72 hours of becoming aware, and notify affected individuals without undue delay where the breach is likely to result in a high risk, in line with NDPA Section 40 and the GAID.

10. Children

The Platform is not directed at persons under 18. We do not knowingly collect personal data from children.

11. Changes

We may update this Privacy Policy for legal or operational changes. Material updates will be published on the Platform and may require renewed acceptance before continued use of gated features.