Privacy Policy

Data Controller, Registration, and Data Protection Officer

Shelta Homes and Ventures acts as a Data Controller in relation to the personal data processed through the Platform. Because we process payment, wallet, and escrow data, we may fall within the Nigeria Data Protection Commission's (NDPC) criteria for a “data controller of major importance.” Where this classification applies to us, we will: register with the NDPC; appoint a qualified Data Protection Officer (DPO) or designate a suitably qualified individual responsible for our data protection compliance; and complete any applicable annual compliance audits and filings. We keep this status under active review as our user base and processing activities grow, and will update this Policy with our DPO's direct contact details once appointed. In the meantime, all data protection queries can be directed to hello@sheltahomes.com.

Information We Collect

We collect personal data in the following ways:

Children's Privacy

The Platform is intended for individuals who are at least 18 years old. We do not knowingly collect personal data from children. Where we have reason to believe a user may be under 18, we may request age verification and, where necessary, suspend the account and delete the associated personal data. If we become aware that personal data relating to a child has been collected without appropriate legal authorization, we will take reasonable steps to delete that information in accordance with applicable law.

How We Use Your Information

We process your personal data only where we have a lawful basis under the Nigeria Data Protection Act 2023 (NDPA), including your consent (where required), the performance of a contract, compliance with a legal obligation, our legitimate interests, or any other lawful basis permitted by applicable law.

We use your personal data to:

• Create, manage, and secure your account.
• Provide, operate, maintain, and improve the Platform and its services.
• Facilitate accommodation searches, property listings, roommate matching, in-app messaging, escrow payments, wallet services, withdrawals, and other Platform features.
• Process and maintain records of transactions and payments.
• Verify user identity where necessary to prevent fraud or protect the Platform.
• Personalize your experience by providing relevant property recommendations, roommate suggestions, and other tailored content.
• Communicate with you regarding your account, transactions, support requests, Platform updates, security alerts, and other service-related notices.
• Respond to enquiries, complaints, and customer support requests.
• Monitor, investigate, detect, and prevent fraud, abuse, unauthorized access, and other security incidents.
• Analyse Platform usage to improve functionality, performance, accessibility, and user experience.
• Comply with applicable laws, regulatory requirements, lawful requests from competent authorities, and our internal compliance obligations.
• Enforce our Terms of Service and protect the rights, safety, property, and legitimate interests of Shelta, our users, and third parties.
• Send marketing or promotional communications where permitted by law or with your consent. You may opt out of marketing communications at any time.

Where users voluntarily provide personal information for roommate matching, including lifestyle preferences or other profile information, we use that information solely to facilitate the matching process and improve user experience. Certain roommate-matching fields, such as religion, are optional special category data under the NDPA. We only collect these fields with your explicit, separate consent at the time you complete your profile; you may decline to provide them without affecting your ability to use core Platform features; and you may withdraw consent and remove this information from your profile at any time.

Automated Decision-Making and Profiling

Shelta uses automated processes to support certain Platform features, including roommate matching and personalized recommendations. These processes analyse information that you voluntarily provide, such as your accommodation preferences, budget, lifestyle preferences, location, gender, religion (where voluntarily provided), and other relevant profile information, to suggest suitable matches.

These automated processes are intended to assist users and do not make legally binding decisions on your behalf. You remain free to accept, reject, or ignore any suggested match.

Where required by applicable law, you have the right to object to or request a review of automated processing that produces legal or similarly significant effects on you. To exercise this right, please contact us at hello@sheltahomes.com.

Sharing Your Information

We may share your personal data only where necessary and in accordance with applicable law.

We may share your information with:

• Other Users: To facilitate the services provided through the Platform, we may share limited information with other users, such as your public profile, property listings, roommate profile information, messages, or other information you choose to make available. You remain in control of the information you choose to include in your profile or share through the Platform.
• Service Providers: We may share your personal data with trusted third-party service providers, including hosting, cloud, payment, analytics, communication, and other vendors that help us operate the Platform. These providers process personal data on our behalf under appropriate contractual, confidentiality, and data protection obligations.
• Legal, Regulatory, and Safety Purposes: We may disclose your personal data where required by law, court order, or lawful request from a competent authority, or where necessary to investigate fraud, enforce our Terms, or protect the rights, safety, and security of Shelta, our users, or others.
• Professional Advisers: We may share your personal data with our legal advisers, auditors, accountants, insurers, and other professional advisers where necessary for legal, regulatory, or business purposes.
• Business Transfers: If Shelta undergoes a merger, acquisition, restructuring, or sale of its business or assets, your personal data may be transferred as part of that transaction, subject to applicable law.
• With Your Consent: We may share your personal data for other purposes with your consent or as otherwise permitted by applicable law.

We do not sell your personal data to third parties for their own marketing purposes.

Data Security

We implement appropriate technical, organizational, and administrative measures designed to protect your personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction, in accordance with the Nigeria Data Protection Act 2023 (NDPA) and other applicable laws.

Our security measures may include, where appropriate:

• Encryption of data in transit and, where applicable, at rest.
• Role-based access controls and authentication mechanisms.
• Security monitoring, logging, and regular risk assessments.
• Secure backup and recovery procedures.
• Employee confidentiality obligations and access restrictions.
• Periodic security reviews and testing of our systems.

We also require our third-party service providers that process personal data on our behalf to implement appropriate security measures consistent with applicable data protection laws.

While we take reasonable steps to protect your personal data, no method of electronic transmission or storage is completely secure. Accordingly, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your Account credentials and for securing the devices you use to access the Platform.

Where a personal data breach occurs, we will take appropriate steps to contain and investigate the incident and will notify affected individuals and the Nigeria Data Protection Commission (NDPC), where required by applicable law.

Your Rights and Choices

Subject to applicable law, you have the following rights under the Nigeria Data Protection Act 2023 (NDPA):

• The right to be informed about how your personal data is processed.
• The right to access your personal data.
• The right to request the correction of inaccurate or incomplete personal data.
• The right to request the deletion of your personal data where applicable.
• The right to restrict or object to certain types of processing.
• The right to data portability where applicable.
• The right to withdraw your consent at any time where processing is based on consent.
• The right not to be subject to solely automated decisions that produce legal or similarly significant effects, except where permitted by law.
• The right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of your rights, please contact us at hello@sheltahomes.com. We will respond within the time required by applicable law. Where permitted, we may request additional information to verify your identity before processing your request.

You can manage cookie preferences through your browser settings, although disabling certain cookies may affect the functionality of the Platform.

International Data Transfers

Your personal data may be processed or stored outside Nigeria where necessary to provide our services (for example, cloud hosting and storage) or where we engage third-party service providers located outside Nigeria.

Where personal data is transferred internationally, we ensure appropriate safeguards are in place in accordance with the NDPA, including one or more of the following:

• Transfers to jurisdictions recognized by the NDPC as providing an adequate level of protection.
• Standard contractual clauses or equivalent data protection agreements with the recipient.
• Other lawful transfer mechanisms permitted under applicable law.

We will name the specific safeguard mechanisms and categories of recipients here as our vendor and hosting arrangements are finalized.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, comply with applicable legal and regulatory obligations, resolve disputes, enforce our agreements, and protect our legitimate interests. Our retention periods include, without limitation:

• Account and profile information: retained for as long as your account remains active, and for a reasonable period after closure to allow for account recovery and to meet legal obligations.
• Transaction, payment, and escrow records: retained for a minimum of five (5) years from the date of the relevant transaction, in line with the Money Laundering (Prevention and Prohibition) Act 2022 and applicable Central Bank of Nigeria anti-money laundering requirements.
• Identity verification (KYC) records: retained for a minimum of ten (10) years after account closure or the end of our relationship with you, in line with applicable anti-money laundering requirements.
• Messages and communications: retained for as long as necessary to support the relevant transaction or dispute resolution, or as otherwise required by law.
• Marketing preferences: retained until you opt out or withdraw consent.

When personal data is no longer required, we will securely delete, anonymize, or otherwise dispose of it in accordance with applicable law and our internal data retention procedures.

Third-Party Services

The Platform may contain links to or integrate with third-party websites, applications, or services. Their privacy practices are governed by their own privacy policies, and we encourage you to review those policies before providing any personal information.

Where third-party service providers process personal data on our behalf, we require them to implement appropriate security and confidentiality measures and to comply with applicable data protection laws.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business operations, legal requirements, or data processing practices.

Where we make material changes, we will notify users through the Platform, by email, or by other appropriate means before the changes take effect. The updated Privacy Policy will include the revised “Last Updated” date.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, you may contact us at:

Email: hello@sheltahomes.com

If you believe that we have not addressed your concerns, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) in accordance with applicable law.

Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria.