Privacy Policy

SpaceFinda Technologies Ltd is the data controller responsible for your personal data. We are registered in Nigeria and operate the SpaceFinda short-let and workspace booking platform. Our platform connects renters with property owners across Nigeria, starting with Ibadan.

Data Protection Officer: As a startup, our Data Protection responsibilities are currently handled by the founding team. Contact: dpo@spacefinda.com

Information you provide directly

• Account information: First name, last name, email address, phone number, password (stored as an encrypted hash, never in plain text)
• Profile information: Profile photo, bio, home state, travel preferences, emergency contact name and phone number
• Identity verification: Government-issued ID document (NIN slip, National ID card, Driver's licence, or International passport), selfie photograph submitted for face-match verification
• Booking information: Property selections, check-in and check-out dates, number of guests, special requests
• Payment information: A secure payment token representing your card is stored. We never store your raw card number, CVV, or expiry date. These are handled exclusively by Paystack.
• Reviews and ratings: Content you submit as a review after a completed stay
• Emergency contact: Name, relationship, and phone number of your designated emergency contact

Information collected automatically

• Usage data: Pages visited, searches performed, listings viewed, booking flow interactions
• Device information: IP address, browser type, operating system, device type collected at the point of login for fraud prevention purposes
• Session data: Login timestamps, session duration

Information from third parties

• Paystack: Transaction status and confirmation data following payment processing

We collect data when you create an account, complete your profile, make or receive a booking, submit payment, send messages on the platform, submit an identity verification document, contact our support team, or use any feature of the SpaceFinda platform.

Automatic collection occurs when you access and use our website or mobile application through standard web technologies including server logs and session management tools.

Under the NDPA 2023, we process your personal data on the following lawful bases:

• Contract performance: Processing necessary to fulfil the booking contract between you and SpaceFinda or between you and a property owner
• Legitimate interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, and service improvement, where these are not overridden by your rights
• Consent: Where you have clearly opted in, such as marketing communications. You may withdraw consent at any time through your account settings.
• Legal obligation: Where we are required to process data to comply with Nigerian law, including anti-money laundering requirements
• Vital interests: In genuine emergency situations involving risk to life, where we may need to share emergency contact information

We do not share data with advertising networks, data brokers, or any entity for commercial purposes unrelated to providing the SpaceFinda service.

We may disclose your data to regulatory authorities or law enforcement agencies if required by Nigerian law or court order.

The Nigeria Data Protection Act 2023 gives you the following rights over your personal data:

To exercise any of these rights, contact us at privacy@spacefinda.com with your full name and account email. We will respond within 30 days. For data access requests, we may need to verify your identity before releasing any information.

Requesting a copy of your data

You can request a complete export of all personal data SpaceFinda holds about you by visiting Account Settings and selecting "Request my data", or by emailing privacy@spacefinda.com. We will compile and deliver your data within 30 days in a commonly used, machine-readable format.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted in our database
• Passwords are hashed using bcrypt — never stored in plain text
• Payment card data is handled exclusively by Paystack (PCI-DSS Level 1 compliant) — SpaceFinda stores only payment tokens
• Identity documents are stored temporarily in an access-controlled environment and deleted within 30 days of verification
• Access to production data is restricted to authorised personnel only
• We conduct regular security reviews of our infrastructure

In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify the NDPC within 72 hours and notify affected users without undue delay, as required by the NDPA 2023.

SpaceFinda is not intended for use by persons under the age of 18. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@spacefinda.com and we will delete the information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will notify you of significant changes by email to the address on your account and by displaying a prominent notice on the platform at least 14 days before any material change takes effect. The date of the most recent revision appears at the top of this policy.

Your continued use of SpaceFinda after the effective date of any change constitutes your acceptance of the updated policy.