Loading
How Vallo collects, uses and protects your personal data, and the rights the Nigeria Data Protection Act 2023 gives you over it.
Last updated: 25 September 2026
Vallo is a marketplace for property and stays in Nigeria: homes to rent, property for sale, land, shops and offices, and stays, hotels and restaurants listed by the people who run them. It is operated by VALLO SPACES LTD (RC 9870413), a private company limited by shares registered in Nigeria under the Companies and Allied Matters Act 2020, whose registered office is Plot 5, Zone 6, Dutse Alhaji, Bwari Area Council, Federal Capital Territory, Abuja.
For the purposes of the Nigeria Data Protection Act 2023 (the "NDPA"), VALLO SPACES LTD (RC 9870413) is the data controller for the personal data described in this policy. Where this policy says "we" or "us", it means that company.
Our Data Protection Officer is Omojuni Oluwaseyifunmi Ebenezer. Questions about this policy, about the data we hold about you, or any request to exercise the rights in section 8, should go to the contact form, with Privacy as the subject. Requests sent that way reach the Data Protection Officer.
We collect only what the platform needs to work:
Every use of your data rests on a lawful basis recognised by the NDPA:
We do not sell personal data. We share it only where the service requires:
Our database and files are stored in Ireland (EU). Some of our providers named in section 5 process data in the United States, Switzerland or elsewhere. Where personal data leaves Nigeria we rely on the transfer mechanisms the NDPA permits, including transfers to jurisdictions providing adequate protection and contractual safeguards with our providers, so your data keeps the same level of protection wherever it is processed.
We keep personal data only as long as we need it. While your account is open we keep your profile, your content and your records. When you delete your account, two different things happen to two different kinds of data, and this section says plainly which is which.
You can delete your account yourself, in Settings then Account, in the app or on this website. You do not need to write to us and we do not do it by hand.
Nothing is destroyed for 30 days. The moment you confirm, your account is signed out everywhere and deactivated: you cannot sign in and nobody can reach your profile. We email you the date the deletion runs and a code that stops it. If you use that code inside the window, everything is put back and nothing has been lost. At the end of the 30 days a scheduled job runs the deletion, and we email you again when it has finished.
Destroyed outright. Your profile and the details in it, your photograph and cover picture, your posts, comments, stories and unpublished drafts, your saved properties, stays, tables, searches and interests, your search history, the devices you are signed in on and the device records we keep to warn you about new sign-ins, your notification addresses, your notifications, the emails we had queued or sent you, your price checks and saved price-check spots, your assistant conversations, your saved cards and bank accounts, and every file you have uploaded, including host documents and the identity and agency documents of anybody who applied to be an agent and was not approved. The files are removed from storage, not merely the records that point at them. The one exception is an approved agent’s identification, described below.
Your email address is not kept. We keep only a one-way keyed code made from it, which cannot be turned back into the address. Our staff can use it only to see that a new account uses the same mailbox as a deleted one.
Money is never deleted with an account. On the day the deletion runs we check again. If a payment or a refund is still in progress, a Guarantee claim is open, or money is owed to you or by you, the deletion waits: nothing is destroyed, a person at Vallo is told, and we contact you to settle it first. Your code to stop the deletion keeps working while it waits.
Kept, with you removed from it. Vallo is registered with the Special Control Unit against Money Laundering and is subject to Nigeria’s Money Laundering (Prevention and Prohibition) Act, which requires a business that moves money to retain its transaction records for at least five years after the transaction. So your bookings, reservations, agreements, payments, Guarantee claims, platform revenue lines, payout records, inspection requests and reviews are kept for that period. Your name, email address and telephone number are removed from every one of them, and what remains is an amount, a date and a reference that no longer identifies you. Messages you have sent stay in the other person’s conversation so their side of the thread is still readable, with the sender shown as a deleted account.
This is the retention exception to your right to erasure, and section 8 sets out how to exercise that right. The NDPA permits us to keep personal data where another law requires us to, and this is that case. It is limited to the records named above, for the period named above, and to nothing else.
Verification documents are the clearest example of the line. If you were approved as an agent, you were a customer under the same anti money laundering law, which requires us to keep your identification. So when you delete your account we keep, for five years after it closes, your identity and agency documents, your name, residential address, ID type and number, business registration and payout account details. Only our staff can read them, and at the end of the five years they are destroyed. If you applied and were not approved, none of this is kept: the documents and the numbers are destroyed with the rest of your account.
The full list of what is destroyed and what is kept, and the form that stops a deletion already running, are at the delete account page.
The NDPA gives you rights over your personal data. You can:
Deletion is the one you do not have to ask us for: it is a control in the product, it takes effect immediately, and the delete account page explains it in full. To exercise any of the others, write to us through the contact form. We respond within the timelines the NDPA sets. If you are not satisfied with our response, you have the right to complain to the Nigeria Data Protection Commission (NDPC).
We use only cookies and device storage that the product needs to work, and one first-party cookie for the sign-up step counts in section 2. There is no analytics from a third party, and no advertising or tracking cookie in Vallo.
Vallo is for adults. You must be at least 18 years old to create an account, book a stay or list a property. We do not knowingly collect personal data from children, and we delete any such data we discover.
We protect personal data with encryption in transit, access controls, hashed passwords and payment processing through licensed providers. No system is perfectly secure, so if we ever discover a breach that puts your rights at risk we will notify the NDPC and affected users as the NDPA requires.
Vallo’s assistant, the support chat and the @vallo replies in the social feed are AI. They are powered by Anthropic, a company in the United States. When you use them, what you type, the recent turns of the conversation and the Vallo listings the assistant looks up for you are sent to Anthropic to write the answer.
When we change this policy we will update the date at the top of this page, and for significant changes we will tell you directly through the product or by email before they take effect.
See also our Terms of service, or contact us with any question.
