Privacy Policy

1. Who We Are

Plotmarket (plotmarket.ng) is a property listing platform operated by Oshylabs Ltd (Company No. 16883720). We enable individuals, real estate agents, and property developers to list, discover, and inquire about properties across Nigeria.

For the purposes of the Nigeria Data Protection Act 2023 (“NDPA”) and the Nigeria Data Protection Regulation (“NDPR”), Oshylabs Ltd is the data controller responsible for your personal data.

2. What Data We Collect

We collect the following categories of personal data:

3. How We Use Your Data

We process your personal data for the following purposes:

• Account Management: Creating and maintaining your user account, authenticating your identity, and managing your profile settings.
• Property Listings: Displaying your property listings to other users, enabling search and discovery of properties.
• Payments and Subscriptions: Processing subscription payments, managing billing cycles, and sending payment confirmations.
• Communication: Facilitating property inquiries between users, sending transactional emails (account verification, password resets), and important platform notifications.
• Platform Improvement: Analysing usage patterns to improve features, fix bugs, and enhance user experience.
• Legal Compliance: Meeting our obligations under Nigerian law including NDPA, anti-money laundering regulations, and responding to lawful requests from authorities.
• Safety and Security: Detecting and preventing fraud, abuse, and unauthorised access to the platform.

4. Legal Basis for Processing

Under the NDPA 2023, we rely on the following legal bases:

• Consent: Where you have given clear consent for us to process your personal data for specific purposes, such as creating an account or receiving communications.
• Contractual Necessity: Processing necessary to perform our contract with you, including providing the listing platform, managing subscriptions, and facilitating property inquiries.
• Legitimate Interest: Processing necessary for our legitimate business interests, such as improving the platform, ensuring security, and preventing fraud, provided these interests do not override your fundamental rights.
• Legal Obligation: Processing necessary to comply with Nigerian legal requirements, including tax regulations and responses to lawful government requests.

5. Who We Share Your Data With

We do not sell your personal data. We share your data only with the following categories of recipients, as necessary to operate the platform:

• Supabase: Our database and authentication provider. Supabase stores your account data, profile information, property listings, and media files securely.
• Paystack: Our payment processor. Paystack handles all payment transactions for subscription plans. Paystack is PCI DSS compliant and governed by Nigerian financial regulations.
• Vercel: Our hosting provider. Vercel serves the Plotmarket web application and may process technical data (IP addresses, request logs) as part of delivering the service.
• Other Users: When you list a property, certain information (name, phone number, email, company name) is visible to users who view your listings or send inquiries.
• Law Enforcement: We may disclose data if required by Nigerian law, court order, or a valid request from a government authority.

6. Your Rights Under the NDPA

As a data subject under the Nigeria Data Protection Act 2023, you have the following rights:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to Restriction: You may request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability: You may request a machine-readable copy of the personal data you provided to us.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interest as a legal basis.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at arnold.oshenye@oshylabs.eu. We will respond to your request within 30 days.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure password hashing (passwords are never stored in plain text)
• Row-level security policies on database tables
• Access controls limiting data access to authorised personnel
• Secure authentication via Supabase Auth with email verification
• Regular security reviews of our infrastructure and dependencies

While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Cookies and Tracking

We use essential cookies to manage authentication and maintain your session. These cookies are strictly necessary for the platform to function and cannot be disabled.

For more details on how we use cookies, please see our Cookie Policy.

9. Data Retention

We retain your personal data for the following periods:

• Account Data: Retained for the duration of your account and for up to 12 months after account deletion to handle any disputes or legal claims.
• Property Listings: Retained for the duration of the listing. Deleted listings are removed within 30 days.
• Media Files: Retained for the duration of the associated listing. Removed when the listing is deleted.
• Payment Records: Retained for 6 years to comply with Nigerian tax and financial regulations.
• Communication Data: Inquiry messages are retained for up to 24 months.
• Usage Data: Aggregated and anonymised data may be retained indefinitely for analytical purposes.

10. Cross-Border Data Transfers

Some of our service providers (Supabase and Vercel) may store or process your data on servers located outside Nigeria. Where your data is transferred outside Nigeria, we ensure that adequate safeguards are in place in accordance with the NDPA 2023, including:

• Transfers to jurisdictions with adequate data protection standards
• Contractual clauses requiring service providers to protect your data to standards equivalent to Nigerian law
• Use of service providers with robust security certifications (SOC 2, ISO 27001, PCI DSS)

11. Children's Privacy

Plotmarket is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you are under 18, you may not create an account or use the platform. If we become aware that we have collected data from a child under 18, we will take steps to delete that information promptly.

12. How to Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data subject rights, or have concerns about how we handle your data, please contact us:

13. Right to Complain

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), the supervisory authority established under the NDPA 2023.

We encourage you to contact us first at arnold.oshenye@oshylabs.eu so we can attempt to resolve your concern directly.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will notify you by posting a notice on the platform or sending an email to your registered address. Your continued use of Plotmarket after changes are posted constitutes acceptance of the updated policy.