Privacy Policy

CicilyHomes Estates ("CicilyHomes", "we", "us", "our") operates an online rental platform connecting landlords and tenants in Abuja, Nigeria, at cicilyhomes.com. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, how we protect it, and the rights you have under the Nigeria Data Protection Act 2023 ("NDPA") and other applicable Nigerian law. For the purposes of the NDPA, CicilyHomes is the data controller of the personal data described here.

Please read this policy together with our Terms of Service. If you do not agree with how we handle personal data, please do not use the platform.

1. Information we collect

Account information. Name, email address, phone number (optional), area of residence, role (tenant or landlord), payment-plan preference, and a password (see Section 4 on how passwords are stored).

Identity verification data. The National Identification Number (NIN) you submit so that our team can manually review your identity.

Bank details (landlords). Bank name, account number and account name, used to review and record where rent is to be paid.

Property and verification documents. Property details and photos, utility bills, bank-transfer payment receipts and any other document you upload to support a listing, verification or payment.

Platform activity. Viewing requests, lease records and signatures, invoices, payment records (amounts, status, transfer reference and date), maintenance requests, saved listings, notifications, and messages you send through our contact form.

Trust score. The platform calculates a trust score for accounts from verification status and activity on the platform. This is an automated calculation; see Section 7 for your rights in relation to it.

Technical and security data. IP address, browser/user-agent, login timestamps, and security events (such as failed logins, password resets and two-factor authentication changes), kept for account security and fraud prevention. We also keep a log of emails sent by the platform (recipient, subject, purpose and delivery status).

2. Why we use it, and our lawful basis

• To create and secure your account and to ensure landlords, tenants and administrators only see what their role entitles them to. (Performance of our agreement with you.)
• To manually review landlord and tenant identity and property documents before a listing is published or a lease is signed — see "How verification works" on our About page for what this does and does not check today. (Our legitimate interest in a trustworthy platform and, where you submit data for this purpose, your consent.)
• To record, confirm and reconcile rent payments and issue receipts. (Performance of our agreement with you; legal obligations.)
• To detect and prevent fraud, impersonation, account takeover and abuse. (Legitimate interests; legal obligations.)
• To send you account, verification, payment, maintenance and security notifications.
• To comply with legal obligations and respond to lawful requests from authorities.

We do not sell your personal data. We do not use your NIN or bank details for any purpose beyond identity verification and rent-payment recording.

3. Who we share data with

We share personal data only where needed for the platform to operate:

• Other users, to the extent needed for a rental. For example, a landlord can see a tenant's name, contact details and verification status for a viewing request or lease, and a tenant sees the landlord's listing and contact details. We do not show a user's NIN, or a landlord's bank account number, to other users.
• Service providers that help us run the platform, acting on our instructions: our web hosting and infrastructure provider, and our email delivery provider (to send you notifications). Some pages load standard code libraries, fonts and icons from third-party content delivery networks, which means your IP address and browser details are visible to those networks when you load the page.
• Payment and verification providers. At the time of this update, rent is paid by bank transfer and confirmed by our team, and identity and document checks are done by manual review, so no payment processor or identity-verification provider receives your data through the platform. If we enable an online payment provider or an automated identity, bank-account or document check in future, we will share only the data needed for that service and will update this policy first.
• Authorities and advisers. Law enforcement, regulators, courts, and our professional advisers, where required by law or needed to establish or defend legal claims.

Our hosting and service providers may process data outside Nigeria. Where personal data is transferred outside Nigeria, we will do so only in line with the NDPA's requirements for cross-border transfers.

4. How we protect your data

We use the following measures. No system is completely secure, and we cannot guarantee that a security incident will never occur.

• Passwords are stored only as a one-way cryptographic hash, so they cannot be read back, including by us.
• Your NIN and bank account number are encrypted in our database.
• Uploaded documents are stored outside the public web folder and are served only through an authenticated, access-logged endpoint, not by a public link.
• Optional two-factor authentication is available for every account.
• Sessions are protected against fixation and cross-site request forgery, and repeated failed logins temporarily lock an account.
• Access to administrative functions is restricted to authorised staff, and administrative actions are recorded in an audit log.

If a personal data breach occurs, we will notify the Nigeria Data Protection Commission and affected individuals where and when the NDPA requires us to.

5. Data retention

We keep account, lease, invoice and payment records for as long as your account is active and afterwards for as long as reasonably necessary for tax, accounting, legal-claim and dispute-resolution purposes. Technical application logs are automatically deleted after about 90 days; security and audit records may be kept longer to investigate fraud and abuse. When we no longer need personal data, we delete or anonymise it. You can ask for deletion as described in Section 7, subject to records we are legally required or entitled to keep (for example completed payment records).

6. Cookies and similar technologies

We use an essential session cookie to keep you logged in (HttpOnly, SameSite, and Secure over HTTPS) and a browser-storage setting for your light/dark theme preference. We do not use third-party advertising cookies.

7. Your rights

Subject to the conditions and exceptions in the NDPA, you have the right to:

• be informed about, and obtain confirmation of whether we process, your personal data, and access a copy of it;
• have inaccurate or incomplete data corrected;
• request erasure of your personal data, where we are not entitled or required to keep it;
• object to, or ask us to restrict, certain processing;
• receive your data in a structured, commonly used format, and ask for it to be transferred, where applicable (data portability);
• withdraw your consent at any time where we rely on consent, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review of such a decision. Our trust score is an automated calculation; verification and account decisions are reviewed by our team; and
• lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled, in addition to contacting us first.

To exercise any of these rights, email support@cicilyhomes.com with "Privacy request" in the subject. We may need to verify your identity before acting on a request, and we will respond within the time required by law.

8. Children's privacy

CicilyHomes is intended for adults entering into rental arrangements and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will take appropriate steps.

9. Changes to this policy

We may update this policy as the platform changes, for example if we add online payments or automated verification. We will publish the updated policy on this page with a new "Last updated" date and, for material changes, give notice through the platform or by email where reasonably practicable. Where the law requires your fresh consent for a new use of your data, we will ask for it rather than treat continued use as consent.

10. Contact us

For privacy requests or concerns: support@cicilyhomes.com, or by mail at 1 Zilly Aggrey drive, Epic Center 4th floor, Idu Karmo, FCT, Nigeria.