Privacy Policy

This Privacy Policy explains how Lodge ("Lodge," "we," "us") collects, uses, shares, and protects personal data when you use the Lodge platform, website, and mobile applications (the "Platform"), as a Host, Guest, or visitor.

This Policy is written to comply with the Nigeria Data Protection Act, 2023 ("NDPA"), which is enforced by the Nigeria Data Protection Commission (NDPC) and governs the processing of personal data of individuals in Nigeria. It applies regardless of whether Lodge is domiciled in Nigeria, since the NDPA applies to processing of personal data of data subjects located in Nigeria.

By using the Platform, you acknowledge the practices described in this Policy.

We collect the following categories of personal data:

We collect this information directly from you when you register, create a Listing, or make a Booking, and automatically as you use the Platform.

We use personal data to:

• Create and manage your account, and verify your identity
• Facilitate Bookings, process payments, and calculate Service Fees
• Enable communication between Hosts and Guests
• Provide customer support and resolve disputes
• Detect and prevent fraud, abuse, and security incidents
• Send Booking confirmations, receipts, and service-related notifications
• Improve the Platform through aggregated, de-identified usage analysis
• Send marketing communications, where you have opted in (you can opt out at any time)

Under the NDPA, we rely on the following legal bases depending on the purpose:

• Performance of a contract — processing needed to create your account, complete a Booking, or deliver the service you requested
• Consent — for marketing communications and optional features such as location-based search; consent is obtained explicitly and can be withdrawn as easily as it was given
• Legal obligation — where processing is required to comply with Nigerian law, such as tax or anti-fraud requirements
• Legitimate interest — for fraud prevention, Platform security, and service improvement, balanced against your rights and freedoms

Where consent is our basis for a particular use, you may withdraw it at any time through your account settings or by contacting us, without affecting processing already carried out.

We share personal data only as needed to operate the Platform:

• Between Hosts and Guests — necessary Booking details (name, contact information, arrival details) are shared between the two parties to a confirmed Booking
• Payment processors — Booking and payment details are shared with our licensed third-party payment processor (e.g. Paystack or Flutterwave) to complete transactions; Lodge does not itself hold or process card data
• Service providers — hosting, analytics, customer support, and identity verification vendors, bound by data processing agreements
• Legal & regulatory bodies — where required by law, court order, or to protect the rights, safety, or property of Lodge or its Users

We do not sell personal data to third parties.

We retain personal data for as long as your account is active, and afterward for as long as needed to fulfil the purposes described in this Policy, including:

• Resolving disputes and enforcing our Terms
• Complying with tax, accounting, and anti-fraud legal obligations
• Maintaining records of Bookings in case of a later claim

When data is no longer needed for these purposes, we delete or anonymise it. You may request earlier deletion of your account data, subject to Section 7 below and any legal retention requirements that override that request (for example, financial records subject to statutory retention periods).

As a data subject under the NDPA, you have the right to:

• Access — request confirmation of what personal data we hold about you and receive a copy
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your data where there is no compelling reason for us to keep it
• Restrict processing — request that we pause processing in certain circumstances, such as while a dispute over accuracy is resolved
• Data portability — receive your data in a structured, commonly used, machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — withdraw consent at any time, as easily as it was given

To exercise any of these rights, contact us at support@lodgeapp.app. We will respond within a reasonable time as required under the NDPA. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data has been mishandled.

We implement technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit and, where applicable, at rest
• Access controls limiting who at Lodge can view personal data
• Regular review of our systems for vulnerabilities
• Restricting card and payment data handling to our licensed payment processor rather than storing it ourselves

No method of transmission or storage is completely secure. In the event of a data breach likely to result in high risk to your rights, we will notify affected Users and, where required, the NDPC, without undue delay.

We use cookies and similar technologies to keep you logged in, remember your preferences, and understand how the Platform is used, so we can improve it. Some cookies are essential to the Platform's operation; others (such as analytics cookies) are optional.

You can control non-essential cookies through your browser or device settings, or through any cookie preference tool we provide on the Platform. Disabling essential cookies may affect the Platform's functionality.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified through the Platform or by email before taking effect.

For questions about this Policy, to exercise your data rights, or to reach our Data Protection Officer, contact us at support@lodgeapp.app. As Lodge grows and begins processing personal data of more than 200 data subjects, a formal Data Protection Officer will be appointed and registered with the NDPC in line with NDPA requirements for organisations of that size.