Privacy policy

Vallo is a marketplace for property in Nigeria: homes to rent, property for sale, land, shops and offices, and stays, hotels and restaurants listed by the people who run them. It is operated by VALLO SPACES LTD, a private company limited by shares registered in Nigeria under the Companies and Allied Matters Act 2020, whose registered office is Plot 5, Zone 6, Dutse Alhaji, Bwari Area Council, Federal Capital Territory, Abuja.

For the purposes of the Nigeria Data Protection Act 2023 (the "NDPA"), VALLO SPACES LTDis the data controller for the personal data described in this policy. Where this policy says "we" or "us", it means that company.

Our Data Protection Officer is Omojuni Oluwaseyifunmi Ebenezer. Questions about this policy, about the data we hold about you, or any request to exercise the rights in section 8, should go to the contact form, with Privacy as the subject. Requests sent that way reach the Data Protection Officer.

We collect only what the platform needs to work:

• Account data. Your name, email address, phone number, password (stored only in hashed form) and language preference.
• Booking data. The listings you view, the bookings you make, dates, guests, messages you exchange with agents, and reviews you write.
• Payment data. Payment references, amounts, refund history and your wallet balance. Card details are handled by licensed Nigerian payment processors; we never store your full card number.
• Agent verification data. If you apply to become an agent, your government issued ID or NIN, business registration documents where applicable, and the bank account you nominate for payouts.
• Technical data. Device type, browser, IP address, and how you move through the product, used to keep the service working and secure.

• To create and run your account and show the platform in your language.
• To process bookings, take payments, issue refunds and pay people out.
• To verify agent identities and keep fraudulent listings off the platform.
• To carry messages between guests and agents about listings and bookings.
• To answer support requests and investigate reports and disputes.
• To keep the service secure, prevent abuse and comply with Nigerian law.
• To send service messages about your bookings and account. Marketing messages are sent only with your consent, and every one includes a way to opt out.

Every use of your data rests on a lawful basis recognised by the NDPA:

• Contract. Running your account, processing your bookings and paying agents are all necessary to provide the service you signed up for.
• Legal obligation. Identity verification, financial record keeping and responding to lawful requests from Nigerian authorities.
• Legitimate interest. Fraud prevention, platform security and improving the product, balanced against your rights.
• Consent. Marketing communications and any optional features that ask for it. Consent can be withdrawn at any time without affecting your use of the platform.

We do not sell personal data. We share it only where the service requires:

• Agents and the people who contact them. When you book a stay, request an inspection, apply for a tenancy or enquire about a sale, the agent sees the details they need to answer you. When you list, the people who contact you see your public agent profile.
• Payment processors. Licensed Nigerian providers that process payments, refunds and payouts on our behalf.
• Service providers. Hosting, analytics and communication providers who process data under contract and only on our instructions.
• Authorities. Where Nigerian law requires it, or to protect the safety of our users, and only to the extent required.

Our infrastructure providers may store data on servers outside Nigeria. Where personal data leaves Nigeria we rely on the transfer mechanisms permitted by the NDPA, including transfers to jurisdictions providing adequate protection and contractual safeguards with our providers, so your data keeps the same level of protection wherever it is processed.

We keep personal data only as long as it is needed. Account data is kept while your account is active and deleted or anonymised within a reasonable period after you close it. Booking and payment records are kept for as long as Nigerian financial and tax rules require. Verification documents are kept while you remain an agent and for the period the law requires afterwards.

The NDPA gives you rights over your personal data. You can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to delete data we no longer have a lawful reason to keep.
• Object to, or ask us to restrict, certain processing.
• Ask for your data in a portable format.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, write to us through the contact form. We respond within the timelines the NDPA sets. If you are not satisfied with our response, you have the right to complain to the Nigeria Data Protection Commission (NDPC).

We use a small number of cookies and similar technologies: strictly necessary ones that keep you signed in and remember your language and theme, and analytics that help us understand how the product is used so we can improve it. We do not use cookies to sell your attention to third parties.

Vallo is for adults. You must be at least 18 years old to create an account, book a stay or list a property. We do not knowingly collect personal data from children, and we delete any such data we discover.

We protect personal data with encryption in transit, access controls, hashed passwords and payment processing through licensed providers. No system is perfectly secure, so if we ever discover a breach that puts your rights at risk we will notify the NDPC and affected users as the NDPA requires.

When we change this policy we will update the date at the top of this page, and for significant changes we will tell you directly through the product or by email before they take effect.