Privacy Policy

1. Who We Are & Scope

3 A First Realtor Ltd is the data controller for personal data processed through https://aaarealestate.ng and its related subdomains and apps (the "Platform"). This Policy applies to buyers, renters, agents, and anyone who visits the Platform, whether or not they create an account.

2. Data We Collect

We collect the following categories of personal data:

• Account data — full name, email address, phone number, password (stored as a salted hash, never in plain text), and role (buyer, agent, or admin).
• Agent/agency data — agency name, office address, WhatsApp number, years of experience, agency logo, and CAC registration number.
• Verification data — government-issued ID or CAC certificate uploaded for agent verification (see Section 5).
• Listing data — property details, photographs, and location submitted by agents.
• Inquiry data — name, email, phone number, and message content submitted through a property inquiry form, whether or not you're logged in.
• Transaction data — subscription plan, payment amount, payment reference, and status of Paystack transactions. We do not collect or store your card number, CVV, or bank PIN — these are entered directly on Paystack's secure payment page and never touch our servers.
• Usage data — pages viewed, listings favorited, search filters used, approximate location (derived from IP address), device/browser type, and referring site.
• Communications — anything you send us directly via the contact form, email, or support channels.

3. How We Use Your Data

We use personal data to:

• Create and manage your account, and authenticate your logins;
• Publish and display agent listings, and connect buyer inquiries to the relevant agent;
• Process subscription and boost payments, and maintain a record of transactions for accounting and dispute purposes;
• Review and verify agent identity/KYC documents before granting a "Verified" badge;
• Send transactional emails — welcome messages, listing approval/rejection notices, inquiry notifications, payment receipts, plan/listing expiry reminders, and password resets;
• Detect, investigate, and prevent fraud, duplicate listings, spam, and abuse of the Platform;
• Maintain an admin activity log for accountability and security auditing;
• Analyze aggregated, non-identifying usage patterns to improve site performance and content;
• Comply with legal obligations, respond to lawful requests from regulators or law enforcement, and enforce our Terms of Service.

We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

4. Legal Basis for Processing

Under the NDPA, we rely on the following lawful bases:

• Performance of a contract — processing needed to provide the account/listing/inquiry features you sign up for;
• Legitimate interest — fraud prevention, platform security, service improvement, where this doesn't override your fundamental rights;
• Consent — non-essential cookies, and marketing communications (which you may withdraw at any time);
• Legal obligation — record-keeping for tax, accounting, and regulatory compliance.

5. KYC & Verification Documents

Identity and CAC documents uploaded for agent verification are stored in a restricted directory that is not directly accessible over the internet, and can only be viewed by an authenticated administrator through a dedicated, access-logged review screen. These documents are used solely to confirm the identity and registration status of an agent and are not shared with other users, displayed publicly, or used for any purpose beyond verification and fraud prevention, except where disclosure is legally required (see Section 6).

6. When We Share Your Data

We do not sell personal data. We share it only in these circumstances:

• With agents — when you submit a property inquiry, your name, email, phone number, and message are shared with the listing agent so they can respond to you directly.
• With service providers — payment processing (Paystack), email delivery, and hosting infrastructure, each bound by their own data-handling terms and only given the minimum data needed to perform their function.
• For legal reasons — where required by a court order, regulator, or law enforcement request, or to establish, exercise, or defend a legal claim.
• Business transfer — if the Platform is sold, merged, or restructured, personal data may transfer to the successor entity, subject to this Policy continuing to apply.

7. Third-Party Services

The Platform integrates the following third-party services, each with its own privacy policy:

• Paystack — payment processing for subscriptions and listing boosts.
• Google — Google Analytics/Search Console for traffic insight, and Google OAuth for optional sign-in, where enabled.

We are not responsible for the privacy practices of these third parties beyond the data we directly share with them.

8. Cookies & Similar Technologies

We use:

• Essential cookies — to keep you logged in and maintain session state (e.g. CSRF protection). These cannot be disabled without breaking core site functionality.
• Analytics cookies — to understand aggregate traffic and usage patterns.

You can control or delete cookies through your browser settings at any time; disabling essential cookies will prevent login and form submission from working correctly.

9. Data Retention

• Account data is retained for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, and dispute-resolution obligations.
• KYC/verification documents are retained for as long as the agent account is active or verification status is claimed, and may be retained longer where needed for fraud investigation or legal compliance.
• Transaction records are retained in line with Nigerian tax and accounting record-keeping requirements.
• Inquiry messages are retained for as long as reasonably needed to support the transaction they relate to, and for dispute-resolution purposes thereafter.

Where you request deletion, we will remove or anonymize data that we are not legally required to keep.

10. Security

We apply technical and organizational measures appropriate to the sensitivity of the data involved, including: password hashing (never stored in plain text), HTTPS encryption in transit, restricted server-side access to KYC documents, CSRF protection on forms, and role-based access control separating buyer, agent, and admin capabilities. No system is 100% secure, and we cannot guarantee absolute security of data transmitted to or stored on the Platform. If we become aware of a breach affecting your personal data, we will notify affected users and the Nigeria Data Protection Commission as required by the NDPA.

11. Your Rights

Under the NDPA, you have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data, subject to our legal retention obligations;
• Object to or request restriction of certain processing based on legitimate interest;
• Withdraw consent at any time where processing is based on consent, without affecting processing already carried out;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled.

To exercise any of these rights, contact us using the details in Section 15. We will respond within the timeframe required by applicable law.

12. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, anyone under 18. If we become aware that we have collected data from a minor without appropriate consent, we will delete it promptly.

13. Cross-Border Transfer

Some service providers we use (e.g. cloud infrastructure, analytics) may process data outside Nigeria. Where this occurs, we take reasonable steps to ensure the recipient provides an adequate level of protection consistent with the NDPA, including contractual safeguards with our providers.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated to registered users (e.g. by email or in-app notice) before taking effect. The "Last updated" date above always reflects the current version.

15. Contact / DPO

Questions, data requests, or complaints about this Policy can be sent to support@aaarealestate.ng or via our Contact page. We will route data-subject requests to the appropriate person internally responsible for data protection compliance.