Sections
Privacy and Data Policy
Last Updated: August 2026 | [email protected]
1. Introduction
StayAfrika Booking Limited ("StayAfrika", "we", "our", "us") is committed to protecting the privacy and personal data of everyone who uses our platform. This Privacy & Data Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over your data.
This Policy applies to all Users of the StayAfrika platform, including Guests, Hosts, Service Providers, Experience Hosts, Homefind Agents, tenants, Business Subscribers, and visitors to stayafrika.com. By creating an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy.
2. Who We Are
StayAfrika Booking Limited is the data controller responsible for personal information collected through the StayAfrika platform. We are registered in Nigeria and operate in accordance with the Nigeria Data Protection Act (NDPA) 2023, the principal data protection legislation in Nigeria, as implemented by the NDPC's General Application and Implementation Directive 2025 ("GAID"), under the regulatory oversight of the Nigeria Data Protection Commission (NDPC).
If you have questions about this Policy, contact us at [email protected].
3. Information We Collect
3.1 Information You Provide Directly
- Account registration details: first name, middle name, last name, email address, phone number (WhatsApp), and password
- Identity verification data: National Identification Number (NIN), NIMC slip, selfie photograph, and live facial scan
- Business information: company name, CAC registration number, business address, and social media links
- Listing information: property details, photos, videos, pricing, availability, and location
- Payment information: bank account details for payouts, and the payment method details you use to fund a booking or subscription via Paystack
- Communications: messages, support tickets, and automated message templates
- Reviews and ratings submitted on the Platform
Information Collected Automatically
- Device information: browser type, operating system, device type, and screen size
- Usage data: pages visited, features used, time spent, and click patterns
- IP address and approximate location data
- Cookies and similar tracking technologies
3.2 Information From Third Parties
- Identity verification results from SISSL Verify
- Business registration status from the CAC database
- Google account information, if you choose to register with Google
- Payment and settlement confirmations from Paystack
4. How We Use Your Information
- To create and manage your account on the Platform
- To verify your identity and comply with Nigerian legal requirements
- To process bookings, payments, payouts, and refunds through Paystack
- To facilitate communication between Guests, Hosts, and other Users
- To display listings and enable search and discovery
- To send transactional notifications and Platform updates
- To investigate disputes and protect community safety
- To analyse Platform usage and develop new services
- To comply with Applicable Law
5. Legal Basis for Processing
Under the NDPA 2023, we process your personal data on the following legal grounds:
- Contractual necessity: processing required to provide services you have signed up for
- Legal obligation: processing required to comply with Nigerian laws
- Legitimate interests: processing necessary for fraud prevention and Platform security
- Consent: where you have given explicit consent for marketing or optional data sharing
7. How Payment and Payout Data Is Held
Payment processing and fund custody for the Platform are handled by Paystack, a Central Bank of Nigeria-licensed payment processor. Paystack holds funds at every point between a Guest's payment and a User's withdrawal; StayAfrika does not itself take custody of these funds. What you see as your "balance" in the Platform is a ledger view of funds held on your behalf by Paystack, not a StayAfrika-held wallet.
StayAfrika does not store your full card number, CVV, or bank authentication credentials; Paystack processes and stores this information directly as a PCI-DSS compliant processor. StayAfrika retains only transaction reference numbers, payment status and amount, Paystack customer reference IDs, and bank account details you provide for payout purposes.
8. Data Retention
- 8.1 Identity verification data is retained for as long as your account remains active, and for such additional period thereafter as StayAfrika considers necessary for legal, safety, or regulatory purposes, or as long as required or permitted under NIMC regulations.
- 8.2 Transaction records are retained for a minimum of 7 years.
- 8.3 You may request deletion of your account and associated data at any time.
9. Data Security
We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or destruction, including encryption of data in transit (HTTPS/TLS) and at rest, role-based access controls, regular security reviews, and OTP verification for sensitive account actions. No system is entirely secure. In the event of a data breach, we will notify affected Users and the NDPC in accordance with the NDPA 2023, including notifying the NDPC within 72 hours of becoming aware of the breach where required by law.
11. Cross-Border Data Transfers
Some of our service providers, including DigitalOcean (cloud hosting) and Google (location services), may process data outside Nigeria. Where data is transferred internationally, we ensure appropriate safeguards are in place in accordance with the NDPA 2023.
12. Your Rights
Under the NDPA 2023, you have the right to access, rectify, erase, restrict processing of, port, and object to processing of your personal data, and to withdraw consent at any time. To exercise any of these rights, contact us at [email protected]; we will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission at https://ndpc.gov.ng
13. Children's Privacy
The StayAfrika platform is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.
14. Data Protection Officer
StayAfrika has designated a Data Protection Officer responsible for compliance with this Policy and applicable data protection law. Contact: [email protected]
15. Third-Party Processors
All third-party processors handling personal data on our behalf are required to comply with the NDPA 2023 and have a valid Data Processing Agreement in place with StayAfrika. Current processors include Paystack, SISSL Verify, DigitalOcean, Resend, and Google.
16. Changes to This Policy
We may update this Policy from time to time. We will notify you of significant changes by email or a prominent notice on the Platform. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.