Kanesto Privacy Policy

Kanesto — Building the trusted infrastructure for real estate in Nigeria.

This Privacy Policy explains how Kanesto Technologies Limited ("Kanesto", "we", "us") collects, uses, shares, and protects personal information when you use the Kanesto platform. It is written to reflect what the Platform actually collects and does today, and is intended to align with the Nigeria Data Protection Act 2023 (NDPA) and applicable guidance from the Nigeria Data Protection Commission (NDPC).

Note to reviewer: Sections marked [LEGAL REVIEW] need specific counsel confirmation (e.g. lawful-basis characterisation, international-transfer position, registration obligations). Contact details are placeholders pending confirmation.

1. Categories of Personal Data We Collect

We collect only what the Platform's actual features require:

Account information — full name, email address, password (stored hashed by our authentication provider), account/profile type (e.g. seeker, landlord, agent), avatar image (optional), onboarding preferences (budget range, preferred locations, currency, goals) if you choose to provide them.

Contact information — phone number (optional field on your profile), email address.

Identity/verification information — if you choose to use our optional verification feature, the documents you upload (e.g. a government-issued ID, NIN slip, BVN confirmation slip, utility bill, or CAC business certificate) and the verification outcome. We store the document you upload; we do not separately extract or store your NIN or BVN as a standalone data field beyond what appears in the document itself. Verification is optional — see our Verification & Trust Policy.

Property information — details you enter about a property you list (address, price, description, photographs, room/occupancy configuration) or a property you enquire about.

Payment-related information — transaction records (amount, currency, date, purpose, status, a payment reference), and, for withdrawals, the Nigerian bank account details you provide (bank name, account number, verified account name) so we can pay you. We do not collect or store your card number, CVV, or full card details — these are entered directly into Flutterwave's own secure payment interface and never pass through Kanesto's servers.

Device/technical information — IP address, browser/device type, and similar technical data generated automatically when you use the Platform, for security and diagnostic purposes.

Usage information — pages viewed, searches performed, listings saved, and similar in-product activity, used to operate and improve the Platform.

Communications/support information — messages you send other users through the Platform, and correspondence with our support team.

2. Purposes of Processing and Lawful Bases

| Purpose | Example | Lawful basis under NDPA | |---|---|---| | Creating and operating your account | sign-up, login, profile display | Performance of a contract with you | | Facilitating a listing, application, tenancy, booking, or payment | showing your listing to seekers, processing a payment | Performance of a contract with you | | Verifying identity/property/business where you request it | reviewing an uploaded document | Consent (you choose to submit it) | | Processing payments and payouts | Flutterwave transaction verification, bank payout | Performance of a contract; legal obligation (record-keeping) | | Security, fraud prevention, and platform integrity | detecting suspicious activity | Legitimate interest, legal obligation | | Sending service communications | payment receipts, status updates | Performance of a contract; legal obligation | | Sending marketing communications | product updates, offers | Consent (opt-in/opt-out as described below) | | Complying with law | responding to a lawful request from a regulator or court | Legal obligation |

[LEGAL REVIEW] Confirm each lawful-basis characterisation above against the NDPA's own defined bases, and confirm whether any processing here should instead be justified on "legitimate interest" with a documented balancing assessment.

3. Third-Party Processors

We share personal data with the following categories of third party, only as needed to provide the Platform:

Flutterwave — our payment processor for incoming customer payments (card, bank transfer, USSD). Flutterwave receives what is needed to process your payment (amount, your contact details for the transaction, and your payment-instrument details directly). Flutterwave is a separately regulated Nigerian payment service provider with its own privacy obligations.
Kuda Business — used for processing approved withdrawal payouts to users' bank accounts (recipient bank name, account number, verified account name, and payout amount, only for approved withdrawals).
Hosting/database provider — Supabase (Postgres database, authentication, file storage), which stores the data described in Section 1 on our behalf, under its own security and processing terms.
Resend - email delivery provider, used to send account and notification emails. Kanesto does not currently send SMS.

We do not sell personal data to third parties.

4. Data Security

We apply access controls (row-level security on our database, role-based staff permissions) so that personal data is only reachable by the account it belongs to, or by staff with a legitimate operational reason, and take reasonable technical and organisational measures to protect data against unauthorised access, loss, or misuse. No system is completely secure; see Section 12 for what happens if something goes wrong.

5. Retention

We retain personal data for as long as your account is active, and afterwards for as long as necessary to comply with legal, tax, financial record-keeping, or dispute-resolution obligations, or to enforce our agreements. [LEGAL REVIEW] Confirm specific retention periods against Nigerian financial record-keeping and tax-law requirements (e.g. transaction records), and any NDPA-specific minimum/maximum retention guidance.

6. Your Rights

Under the NDPA, you have rights including the right to:

know what personal data we hold about you and why;
request a copy of your personal data;
request correction of inaccurate data;
request deletion of your data, subject to our legal retention obligations (see Section 5);
withdraw consent where processing is based on consent (e.g. marketing, optional verification documents);
object to certain processing;
lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, contact us at privacy@kanesto.com. We will respond within the timeframe required by applicable NDPA guidance. [LEGAL REVIEW] Confirm the specific statutory response window to state here.

7. Account and Data Deletion

You may request account deletion at any time through [in-app profile setting / support request — confirm actual mechanism before publishing]. We will delete or anonymise personal data we are not otherwise required to retain (see Section 5) — for example, completed transaction records may need to be retained for tax and audit purposes even after account deletion.

8. Cookies and Analytics

[LEGAL REVIEW / PRODUCT CONFIRMATION NEEDED] This section should list the actual cookies, local-storage keys, and any analytics tool currently in use (or state that none beyond strictly necessary session/authentication cookies are used, if that is accurate) before publication. Do not publish a generic cookie list that does not match what the Platform actually sets.

9. Marketing Communications

Where we send you marketing communications, we do so only with your consent (e.g. an opt-in at sign-up or in notification preferences) or another lawful basis permitted by the NDPA, and you may opt out at any time through your notification preferences or by using the unsubscribe mechanism in the message itself.

10. Children and Minors

The Platform is intended for users aged 18 and above who can lawfully transact. We do not knowingly collect personal data from children. If we become aware that a minor has provided personal data, we will delete it.

11. International Data Transfers

Our hosting/database provider may process data on infrastructure located outside Nigeria. [LEGAL REVIEW] Confirm the actual hosting region(s) in use, and the NDPA-compliant transfer mechanism (adequacy, contractual safeguards, or otherwise) that applies, before publication.

12. Breach and Security Incident Handling

If we become aware of a personal-data breach that poses a risk to your rights, we will assess it and, where required by the NDPA, notify the Nigeria Data Protection Commission and affected users within the applicable statutory timeframe. [LEGAL REVIEW] Confirm the specific notification timeframe and threshold to state here.

13. Privacy Contact

Questions or requests about this Policy: privacy@kanesto.com.

14. Policy Updates

We may update this Privacy Policy as the Platform evolves. Material changes will be notified through the Platform before they take effect.

15. Data Protection Compliance Officer

[LEGAL REVIEW] The NDPA requires certain data controllers/processors to designate a Data Protection Officer (DPO) or file certain registrations depending on processing scale and risk. Confirm whether Kanesto currently meets that threshold and, if so, name the appointed officer here before publication.

This document was prepared to describe the Platform as it currently operates and is marked in multiple places for lawyer and product-team confirmation before publication. It is not legal advice.