Privacy Policy.

1. WHO WE ARE

1.1. Xavorian Technology Company, a private limited liability company incorporated under the laws of the Federal Republic of Nigeria, is the data controller responsible for personal data collected through xavorian.com, through the Xavorian waitlist, and through the Xavorian marketplace when it launches. As data controller, we determine the purposes and means of processing your personal data and we are accountable to you and to the supervisory authority for that processing.

1.2. Xavorian is currently in its pre-launch waitlist stage. References in this Policy to marketplace features, identity verification, listings, offers, and payments describe processing that will take place only when the marketplace launches, and they are included now so that you can understand our full intended data practices before you decide to join the waitlist.

1.3. Our Data Protection Officer can be reached at any time through the following channels:

2. SCOPE OF THIS POLICY AND YOUR CONSENT

2.1. This Policy applies to (a) the Xavorian website at xavorian.com, (b) the Xavorian waitlist and any forms, surveys, or communications connected with it, and (c) the Xavorian marketplace, when it launches, including its accounts, listings, chat, offers, and payment features. It applies to all persons whose data we process, including site visitors, waitlist subscribers, and future users registering as property seekers, agents, or landlords.

2.2. When you submit the waitlist form, you give your express consent, by a clear affirmative action, to our processing of the personal data you submit for the purposes described in this Policy. Consent is not bundled with unrelated purposes: we ask only for the data described in Section 3.1 and we use it only for the purposes described in Section 5.

2.3. You may withdraw your consent at any time, free of charge, by emailing xavorianlegal@gmail.com or by using the unsubscribe link in any of our emails. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw consent to waitlist processing, we will remove you from the waitlist within thirty days. Where a different legal basis applies to a specific item of data, for example a legal retention obligation, withdrawal of consent ends the consent-based processing but not the processing the law requires.

2.4. This Policy explains how we handle personal data. Your use of the Platform itself is governed by our Terms and Conditions, which you should read together with this Policy.

3. PERSONAL DATA WE COLLECT

4. LEGAL BASES FOR PROCESSING

4.1. We process personal data only where a lawful basis under the NDPR 2019 and the Nigeria Data Protection Act 2023 applies. Depending on the purpose, we rely on the following bases:

• Performance of a contract or steps before a contract: processing needed to provide the services you request, such as managing your waitlist registration and, at launch, operating your account, listings, offers, and transactions.
• Legal obligation: processing required to comply with Nigerian law, including identity verification, anti-money laundering, fraud prevention, tax and financial record-keeping, and valid court orders.
• Legitimate interests: processing necessary for our legitimate business interests, such as keeping the Platform secure, preventing fraud, planning our city launch order from aggregated waitlist data, and improving the Platform. Before relying on this basis we balance our interests against your rights and freedoms, and we proceed only where your interests do not override ours. You may object to processing based on legitimate interests as described in Section 13.
• Consent: processing we carry out only because you asked us to or agreed that we could, including waitlist communications and, at launch, identity and biometric-adjacent verification data. You may withdraw consent at any time under Section 2.3.

4.2. Where processing is based on consent, withdrawal does not affect processing already completed lawfully. Where processing is based on a legal obligation, we may be unable to act on a deletion request until the relevant statutory retention period ends; we will tell you if that is the case.

5. HOW WE USE YOUR DATA

5.1. We use personal data only for the purposes below, each tied to the legal basis shown:

• To register and manage your position on the waitlist, including confirming your role and city (consent; steps before a contract).
• To send you waitlist updates, launch announcements, and product information you signed up to receive (consent, withdrawable at any time).
• To determine the order in which we launch cities and to plan capacity, using aggregated or de-identified waitlist data rather than identifiable profiles (legitimate interest).
• To respond to your enquiries and provide support (legitimate interest; contract).
• At launch, to create and administer your account, publish and manage listings, process offers and transactions, and operate payment and secure payment arrangements with Paystack (contract).
• At launch, to verify the identity of users through our verification partners before they transact, and to screen listings, documents, and conduct for fraud (legal obligation; legitimate interest in platform safety).
• To send transactional notifications such as verification outcomes, offer alerts, and payment confirmations (contract).
• To monitor, detect, investigate, and prevent fraud and other unlawful use of the Platform, including monitoring in-platform chat for scam activity (legal obligation; legitimate interest; your awareness and consent where required).
• To keep records required by law, to establish or defend legal claims, and to cooperate with competent Nigerian authorities (legal obligation; legitimate interest).
• To analyse aggregated usage data to improve performance, reliability, and the design of the Platform (legitimate interest).

5.2. We will not use your personal data for a purpose that is incompatible with the purposes above without first telling you and, where the law requires, obtaining your consent. We do not use your personal data to make decisions about you that are based solely on automated processing and that have legal or similarly significant effects, except as described in Section 14.

6. BIOMETRIC AND IDENTITY DATA

6.1. This section applies when the marketplace launches and you choose to complete identity verification. Verification is a mandatory gate for transacting users; it is not automatic, and it happens only after you initiate it.

6.2. The liveness or selfie capture is compared with the photograph on your identity document to confirm that the person submitting the document is its genuine holder. It is used for match verification only. We do not use liveness or identity data for advertising, we do not sell, rent, or trade it, and we do not build a searchable biometric database for unrelated purposes.

6.3. Your NIN and BVN are converted to irreversible cryptographic hashes. The plain number is used transiently at the point of verification and is then discarded; it is never stored in plain text and cannot be reconstructed from the stored hash.

6.4. Raw facial liveness captures are deleted immediately once the identity verification match is completed, unless a longer period is specifically mandated by applicable anti-fraud law or a binding court order. Verification outcomes and hashed identifiers are retained in line with Section 10. Verification providers process this data under contract, solely for the verification service, and must delete or return it when the service ends.

7. COOKIES AND TRACKING

7.1. We use a small number of cookies and similar technologies in three categories: strictly necessary cookies that keep the site and your session working; preference cookies that remember choices such as form inputs you have already made; and analytics cookies that help us understand, in aggregate, how visitors use the site so we can improve it.

7.2. We do not use advertising cookies, we do not allow third-party advertising networks to place cookies through our site, and we do not share cookie or tracking data with ad networks.

7.3. You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the site, including the waitlist form, from working correctly.

8. WHO WE SHARE YOUR DATA WITH

8.1. We do not sell your personal data. We do not rent it, trade it, or share it for third-party advertising. We share personal data only in the circumstances below.

8.2. Service providers acting as data processors. We share data with vendors that process it on our behalf and on our documented instructions, including identity verification providers (verification result and risk score only), Paystack for payment and secure payment purposes, email, SMS, and push notification providers that deliver our communications, and hosting and cloud infrastructure providers that store and serve the Platform. Each processor is bound by a written contract to process data only as instructed, to keep it confidential, to apply appropriate security measures, and to delete or return the data when the engagement ends. We conduct due diligence on processors before engaging them.

8.3. Legal authorities. We may disclose personal data to the Nigeria Police Force, the Economic and Financial Crimes Commission (EFCC), the Independent Corrupt Practices Commission (ICPC), the national data protection supervisory authority, or a court where we are required to do so by law or court order, or where we reasonably believe disclosure is necessary to prevent fraud, protect the safety of users, or report suspected criminal conduct. Fraud reports may include identifying and transaction data about the suspected party.

8.4. Professional advisers. We share data with our lawyers, auditors, and insurers where necessary, under strict confidentiality obligations.

8.5. Business transfers. If Xavorian is involved in a merger, acquisition, or sale of all or part of its business, personal data may transfer to the successor entity, which must protect it in a manner equivalent to this Policy. We will notify you of any such transfer and of your choices.

9. INTERNATIONAL DATA TRANSFERS

9.1. Xavorian is a Nigerian company, but some of our service providers, including cloud hosting and email delivery providers, may store or process data on servers located outside Nigeria. This means your personal data may be transferred to and processed in other countries.

9.2. International transfers are made only in accordance with the Nigeria Data Protection Act 2023. Before transferring data we confirm that the destination benefits from an adequacy decision or the transfer is covered by appropriate safeguards, including contractual data protection clauses with the recipient, security due diligence on the vendor, and encryption of data in transit between our systems and theirs.

9.3. You may contact our Data Protection Officer at xavorianlegal@gmail.com to request information about the safeguards applied to a specific transfer of your data.

10. HOW LONG WE KEEP YOUR DATA

10.1. We keep personal data only for as long as necessary for the purpose it was collected for, and for any longer period the law requires. Our current retention schedule is:

• Waitlist data: retained until the marketplace launches, at which point you may register an account or ask us to delete your entry, or until you ask us to delete it sooner, whichever comes first.
• Account data: retained for the life of your account and for seven years after account closure, to satisfy legal, tax, and financial record-keeping obligations under Nigerian law.
• Payment and audit logs: retained for ten years from the date of the transaction, in line with financial record-keeping requirements.
• Identity verification data: verification records and supporting documents retained for the life of the account plus seven years after closure, to satisfy identity verification and anti-fraud obligations; raw liveness captures deleted immediately upon verification completion as described in Section 6.4.
• Correspondence: support and legal correspondence retained for as long as needed to handle the matter and for any resulting retention obligation.

10.2. When you make a valid deletion request we will delete or irreversibly anonymise your personal data within thirty days, except where we must retain specific data because the law requires it, or because it is necessary to resolve an outstanding dispute or establish or defend a legal claim. Residual copies in encrypted backups are overwritten on our scheduled backup cycle.

11. HOW WE PROTECT YOUR DATA

11.1. We apply technical and organisational measures proportionate to the sensitivity of the data we handle:

• NIN and BVN values are stored only as irreversible cryptographic hashes, never in plain text.
• All data transmitted between your device and our servers is encrypted using HTTPS with HSTS enforcement.
• Access to personal data within Xavorian follows least-privilege, need-to-know rules: staff and contractors can access only the data their role requires, and only while they require it.
• Payment card data is processed entirely by Paystack in its own environment; Xavorian does not receive or store card numbers.
• Processors are engaged only after due diligence and only under contracts that impose security and confidentiality obligations.
• Staff with access to personal data are bound by confidentiality undertakings and receive data protection guidance.
• We maintain an incident response plan with defined escalation steps, as described in Section 12.

11.2. No method of transmission over the internet or of electronic storage is completely secure. We work continuously to protect your data, but we cannot guarantee absolute security. You share responsibility for protecting your own data: choose a strong password, keep your credentials confidential, and watch for phishing messages that pretend to come from Xavorian.

12. DATA BREACH NOTIFICATION

12.1. If we become aware of a personal data breach, we will act quickly to contain it, assess its effect, and remediate the cause. Every breach is documented, whether or not it must be reported.

12.2. Where Nigerian law requires notification, we will notify the national data protection supervisory authority, the Nigeria Data Protection Commission (NDPC), which took over the data protection functions previously exercised by the National Information Technology Development Agency (NITDA), within seventy-two hours of becoming aware of the breach.

12.3. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly and without undue delay, using the contact details we hold for you.

12.4. Our notification will tell you, in plain language, what happened, the categories and approximate amount of data affected, the likely consequences, the measures we have taken or propose to take, and how to reach our Data Protection Officer. We will also tell you what you can do, for example resetting credentials or contacting your bank where financial data is involved.

13. YOUR RIGHTS UNDER NIGERIAN LAW

13.1. Under the NDPR 2019 and the Nigeria Data Protection Act 2023 you have the following rights in relation to your personal data:

13.2. To exercise any right, email our Data Protection Officer at xavorianlegal@gmail.com with the subject line "Data Subject Request". To protect you, we may take reasonable steps to confirm your identity before disclosing or acting on personal data. Exercising your rights is free of charge; where a request is manifestly unfounded or excessive we may charge a reasonable fee or decline to act, and we will explain why.

13.3. We will respond within thirty days of a valid request. Where a request is complex or you have made several requests, we may extend this period by up to sixty further days, and we will tell you within the first thirty days if that applies.

13.4. If you are not satisfied with our handling of your personal data or our response to a complaint, you have the right to lodge a complaint with the supervisory authority, the Nigeria Data Protection Commission (NDPC), the body established under the Nigeria Data Protection Act 2023 which succeeded the NDPR-era data protection functions of the National Information Technology Development Agency (NITDA). Complaints may be made through the Commission's official channels, including its website at ndpc.gov.ng.

14. AUTOMATED DECISION-MAKING AND PROFILING

14.1. To keep the Platform safe we use automated systems that produce fraud risk indicators and verification screening results. These systems consider signals such as the consistency of the identity data submitted, the outcome returned by verification partners, device and IP signals, and patterns of conduct associated with known fraud. We describe this logic only at a high level so that it cannot be circumvented by bad actors.

14.2. We do not make decisions that produce legal or similarly significant effects about you, such as restricting your ability to transact, solely by automated means. Where an automated indicator suggests heightened risk, a member of our team reviews the matter before any significant restriction is applied.

14.3. If an automated indicator has affected you, you may contact xavorianlegal@gmail.com to ask for human review, to put forward your point of view, and to contest the outcome. We will have a person re-examine the matter and tell you the result.

15. CHILDREN'S PRIVACY

15.1. The Platform is intended only for persons aged eighteen years and above. We do not knowingly collect personal data from anyone under eighteen. If we discover that we have collected personal data from a person under eighteen, we will delete that data promptly. If you believe a minor has provided us with personal data, please contact xavorianlegal@gmail.com.

16. CHANGES TO THIS POLICY

16.1. We may update this Policy from time to time to reflect changes in our data practices, our product, or applicable law. For material changes, we will give you at least fourteen days' notice, by email to the address we hold for you or through a prominent notice on the Platform, before the change takes effect. The current version will always be available at xavorian.com with its effective date shown at the top. Your continued use of the Platform after an updated Policy takes effect constitutes your acceptance of the updated Policy.

17. CONTACT AND COMPLAINTS

17.1. For all privacy-related questions, requests, or complaints, please contact our Data Protection Office:

17.2. We will acknowledge your enquiry and respond within the timeframes described in Section 13. If you are not satisfied with our response, you may escalate your complaint to the Nigeria Data Protection Commission (NDPC), the supervisory authority under the Nigeria Data Protection Act 2023 (successor to the NDPR-era functions of NITDA), through its official channels including ndpc.gov.ng.