Privacy Policy

1. Introduction

This Privacy Policy is issued by Ogle Property Technology Limited (‘Ogle’, ‘we’, ‘us’, ‘our’). It governs the collection, use, storage, and disclosure of personal data through our website at https://ogle.ng (the ‘Platform’), in compliance with the Nigeria Data Protection Act 2023 (‘NDPA 2023’) and all regulations made thereunder.

Ogle Property Technology Limited is a data controller registered in Nigeria. Our Platform is a booking and reservation service for the buying, selling, renting, and leasing of land and real property. We are committed to protecting your privacy and to processing personal data lawfully, fairly, and transparently.

2. Personal Data We Collect

We collect only the personal data necessary for the purposes described in this Policy. The categories we collect include:

Identity Data: your full name, date of birth, and government-issued identification details.
Contact Data: your email address, phone number, and postal address.
Financial Data: debit and credit card numbers, bank account details, and transaction history.
Location Data: geo-location information (collected with your consent) and property addresses.
Technical Data: your IP address, browser type and version, device identifiers, operating system, app version, and network data.
Usage Data: pages visited, search queries, time spent on pages, interactions with listings, and access dates and times.
Profile Data: your username, password, saved searches, preferences, feedback, and reviews.
Communications Data: messages you exchange with other users through our in-platform messaging system.
Marketing Data: your preferences regarding communications from us and your newsletter subscription status.

We may collect and process certain sensitive personal data, including government-issued identification details and biometric liveness data, solely for identity verification and Know-Your-Customer (KYC) compliance. In accordance with Section 65 of the NDPA 2023, we process this data only upon obtaining your explicit consent or where strictly necessary to comply with a statutory obligation under applicable anti-money laundering and financial regulations. We apply enhanced technical and organisational controls, including strict access restrictions and encryption, to safeguard it.

We do not collect special categories of personal data — such as data revealing racial or ethnic origin, political opinions, religious beliefs, or health data — in the ordinary course of using our Platform.

3. How We Collect Personal Data

We collect your personal data through three main channels:

Directly from you: when you register an account, complete your profile, list a property, make a booking, contact us, respond to a survey, or submit feedback.
Automatically: through cookies, web beacons, and similar tracking technologies as you navigate the Platform. See our Cookie Policy for full details.
From third parties: where you connect a social media account (for example, Google or Facebook), or where we receive information from identity verification providers, fraud-prevention agencies, or publicly available sources, in each case only to the extent permitted by law.

4. Lawful Basis for Processing

The NDPA 2023 requires us to identify a lawful basis for each processing activity. The bases we rely on are:

Contract: we process identity, contact, and financial data where necessary to perform our agreement with you — for example, to create and manage your account, process a booking, or handle a payment.
Legal Obligation: we process certain data to comply with applicable Nigerian law, including financial reporting, tax obligations, and anti-money laundering regulations.
Legitimate Interests: we process technical and usage data for fraud detection, platform security, and analytics, having assessed that these interests are not overridden by your privacy rights.
Consent: we process data for marketing communications, profiling for personalised content, and non-essential cookies only where you have provided explicit, informed, and freely given consent, which you may withdraw at any time without affecting prior processing.

5. Purposes of Processing

We process your personal data for the following purposes:

To create, manage, and maintain your registered account.
To facilitate property searches, bookings, listings, and related transactions.
To process payments and manage billing.
To communicate with you about your transactions, your account, and our services.
To send you marketing communications and newsletters, where you have consented.
To personalise your experience on the Platform.
To detect, investigate, and prevent fraud, security breaches, and illegal activity.
To analyse Platform usage and improve our products and services.
To comply with applicable legal, regulatory, and tax obligations.
To resolve disputes and enforce our agreements with you.

We will only use your personal data for the purposes for which it was collected. If we need to use it for a materially different purpose, we will notify you and, where required by law, seek your consent.

6. Data Sharing and Disclosure

We do not sell your personal data to any third party. We may share it with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate contractual safeguards:

Cloud hosting and infrastructure providers, to store and operate our Platform.
Payment processors, to securely handle payments and refunds.
Identity verification services, for KYC compliance and fraud prevention.
Analytics providers, who receive anonymised or pseudonymised usage data.
Email and SMS service providers, who deliver transactional and marketing communications.
Customer support platforms, to manage user queries and complaints.
Legal and compliance advisors, to the extent necessary for regulatory and legal compliance.
Law enforcement authorities and regulators, where disclosure is required by law, court order, or regulatory direction.
Prospective acquirers or investors, in the event of a merger, acquisition, or corporate restructuring, with advance notice to you.

All third parties who process personal data on our behalf are bound by written data processing agreements requiring them to maintain appropriate security measures, process data only on our documented instructions, and notify us without delay in the event of any breach.

7. International Data Transfers

While our operations are based in Nigeria, your personal data is primarily stored and processed on secure cloud servers located outside Nigeria (including the United States of America and other international server regions). We may update or change our hosting locations as our infrastructure evolves.

To the extent your personal data is transferred or processed outside Nigeria, we ensure such transfers comply with applicable laws, including the NDPA 2023 and NDPC guidance, by ensuring at least one of the following conditions is met:

The receiving country or territory provides an adequate level of data protection;
Appropriate legal safeguards are implemented, such as standard contractual clauses approved by the NDPC or binding corporate rules; or
The transfer is necessary to perform our contract with you, and you have been informed of the transfer.

If you access our Platform from outside Nigeria, you acknowledge and agree that your personal data will be transferred to and processed in our global host locations in accordance with Nigerian data protection standards.

8. Data Security

Our obligations: We implement administrative, physical, and technical security measures appropriate to the risk of processing, including encryption of data in transit and at rest, access controls limiting who may access personal data, and regular security assessments.

Data breach response: In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it, in accordance with the NDPA 2023. Where the breach is likely to result in a high risk to you personally, we will also notify you without undue delay via your registered email or a prominent notice on the Platform.

Your responsibilities: You are responsible for keeping your login credentials confidential. If you know or suspect that your account has been accessed without your authorisation, notify us immediately at fraud@ogle.ng. We reserve the right to suspend any account where we have reasonable grounds to believe credentials have been shared or compromised.

9. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, subject to any applicable legal retention requirements. A full retention schedule is set out in our separate Data Retention Policy.

As a general guide: account data is retained for the duration of your active account plus seven years to comply with Nigerian tax and regulatory requirements; transaction records for seven years; marketing data until you withdraw consent or unsubscribe; technical log data for twelve months. Where your account is inactive for 24 consecutive months, your data is archived, and permanently deleted after 36 months of inactivity unless a legal retention obligation applies.

Where we are required to retain your data beyond the applicable period — for example, due to litigation, a regulatory investigation, or a statutory preservation notice — we will retain it until that obligation is discharged.

10. Children’s Data

Our Platform is not directed at persons under the age of 18, and we do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 18 without verified parental or guardian consent, we will delete it promptly. If you are a parent or guardian and believe your child has provided personal data to us without your consent, please contact us immediately at dpo@ogle.ng.

11. Your Rights Under the NDPA 2023

Subject to applicable legal exemptions, you have the following rights in relation to your personal data held by us:

Right of Access: request a copy of the personal data we hold about you.
Right to Rectification: request correction of any inaccurate or incomplete data.
Right to Erasure: request deletion of your personal data where there is no lawful basis for continued processing.
Right to Restriction: request that we restrict processing in certain circumstances, for example while a dispute about accuracy is resolved.
Right to Object: object to processing carried out on the basis of our legitimate interests, or to processing for direct marketing, at any time.
Right to Data Portability: request a copy of your data in a structured, commonly used, machine-readable format.
Right to Withdraw Consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
Right to Object to Automated Decision-Making: not to be subject to a decision based solely on automated processing, including profiling with significant effects, without human review.
Right to Lodge a Complaint: complain to the Nigeria Data Protection Commission at www.ndpc.gov.ng or info@ndpc.gov.ng.

To exercise any of these rights, submit a written request to dpo@ogle.ng. We will acknowledge your request promptly and respond within 30 days. We may need to verify your identity before processing your request.