Privacy Policy

01Introduction & regulatory preamble

Welcome to Rentilly ("Rentilly", "we", "our", or "us"). We are committed to safeguarding the privacy, confidentiality and statutory rights of our users — Tenants, Landlords, Property Buyers, Partners, Agents and Visitors — across all thirty-six (36) States of the Federal Republic of Nigeria and the Federal Capital Territory (Abuja), as well as our international and diaspora clientele.

This Privacy Policy sets out how we collect, process, store, transfer and protect your personal data in full compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), the General Data Protection Regulation (GDPR) for diaspora and international users, and the consumer safety standards of the Google Play Store and Apple App Store.

By accessing, registering on, or using the Rentilly mobile applications, web platform, APIs or services (collectively, the "Platform"), you acknowledge that you have read, understood and consented to the data practices described in this Policy.

02Data controller & operating scope

• Data Controller: E-Homes Global Inclusive Limited, incorporated under the Companies and Allied Matters Act, Federal Republic of Nigeria (RC: 9063796), in partnership with Pickpadi Global Ltd (RC: 8229347).
• Registered office: No. 4 Ehomes Close, Zartech Area, Oluyole, Ibadan — with operational and digital coverage across all 36 States of Nigeria and the FCT.
• Websites: https://myrentilly.com | https://rentilly.online
• Data Protection Office: privacy@myrentilly.com | dpo@myrentilly.com

03Information you directly provide

We only collect personal information that is necessary, adequate and relevant for verified nationwide real estate matching, property lifecycle management, digital escrow custody and identity verification.

• Identity & profile data: full legal name, date of birth, residential address, nationality, profile photograph, state of residence, Local Government Area (LGA) and next of kin details.
• Contact information: verified email address and verified telephone/mobile number.
• Statutory identity verification data: National Identification Number (NIN) and Bank Verification Number (BVN).
• NDPA mandate on BVN: Rentilly does not store, record or retain your raw 11-digit BVN in our persistent databases. Your BVN is tokenized and transmitted only over TLS 1.3 encrypted connections directly to CBN-licensed identity validation providers, solely to confirm that your registered name and date of birth match official NIBSS banking records. Once validated, the raw number is permanently purged from application memory.
• Property & tenancy records: proof of ownership and title documents across all 36 States and the FCT (Certificate of Occupancy, Governor's Consent, Minister's Consent for FCT Abuja, Gazette, Registered Survey, Deed of Conveyance/Assignment, Customary Right of Occupancy), tenancy covenants, rental rates, inspection reports, utility bills and proof of address.
• Corporate / partner verification data: CAC registration number, Tax Identification Number (TIN), status report and board resolution for corporate entities and property developers.

04Financial & transactional data

• Transaction ledger: rental payment amounts, caution deposit values, milestone release requests, service charge schedules, FX conversions, settlement logs and billing history.
• Banking information: designated payout bank account number, account holder name and financial institution name.
• Debit card credentials and CVV details are processed directly by PCI-DSS Level 1 certified payment switches. Rentilly never handles or stores raw card numbers or CVV codes.

05Automatically collected technical data

• Device & network data: IP address, device model, operating system, unique device identifiers, mobile network provider, browser type and push notification tokens.
• Geolocation data: your location within any Nigerian State or the FCT when uploading inspection media or listing properties, used strictly to detect fraudulent out-of-state listings and geo-tag physical inspection evidence.

06Lawful bases for processing

Under Section 25 of the Nigeria Data Protection Act 2023, we process your personal data on the following lawful bases:

• Performance of a contract: creating your account, operating your rental escrow, generating tenancy memorandums, facilitating rent disbursements and settling partner commissions.
• Legal & statutory obligations: CBN AML/CFT Regulations 2022, the Money Laundering (Prevention and Prohibition) Act 2022, SCUML mandates and State Real Estate Regulatory frameworks (such as LASRERA, EDPA, KSDA).
• Legitimate interests: fraud detection, preventing duplicate account farming, credit security, bot prevention and network integrity.
• Consent: optional direct marketing, promotional updates and non-essential notifications, which you may withdraw at any time.

07How we use your data

• Provisioning dedicated virtual accounts for rent collection and wallet funding through our licensed financial partners.
• Verifying genuine ownership of listed properties across all 36 States and the FCT to protect renters and buyers from fraudulent syndicates.
• Holding security deposits and rental or purchase transactions in multi-party escrow.
• Formatting statutory Tenancy Memorandums compliant with applicable State Tenancy Laws and the Recovery of Premises laws.
• Sending transactional alerts by SMS and email.
• Reconciling inward bank transfer deposits and automating prepaid electricity token delivery for Nigerian electricity distribution companies (DisCos).

08Disclosure & third-party service providers

We do not sell, rent or trade your personal data to advertisers or data brokers. We share your information only with licensed, vetted institutional partners essential to our services:

• Licensed banking & payment partners: CBN-licensed banks and payment service providers, for payment processing and dedicated account provisioning. Rentilly is not a bank; all banking services are provided by these partners.
• Identity verification providers: licensed verification bodies for biometric, NIN and NIBSS BVN identity checks.
• Telecommunications & notification gateways: for two-factor authentication SMS, transactional alerts and mobile push notifications.
• Cloud infrastructure: enterprise hosting using ISO 27001, SOC 2 Type II and PCI-DSS compliant environments with encryption.
• Law enforcement & regulators: when legally compelled by a valid subpoena, court order, or formal request from the NFIU, EFCC or the Nigeria Data Protection Commission (NDPC).

09Security controls

• AES-256 encryption for data at rest.
• TLS 1.3 with HSTS for all network transmissions.
• Multi-factor authentication and mandatory 4-digit Transaction Security PINs for all wallet actions.
• Automated defences against SQL injection, XSS and brute-force attacks, with rate limiting.

10Data retention

Personal and transaction data is retained for the duration of your active account plus seven (7) years after account termination, in line with Nigerian Anti-Money Laundering retention mandates and financial record-keeping laws.

11Your data protection rights

You may exercise any of the rights below. To do so, write to dpo@myrentilly.com. Requests are acknowledged within 48 hours and processed within 30 days, free of charge.

• Right to access a copy of the personal information we hold about you.
• Right to rectification of inaccurate, misleading or outdated information.
• Right to erasure ("right to be forgotten"), subject to statutory legal and financial retention requirements.
• Right to restrict or object to processing based on legitimate interests, or withdraw consent for non-essential services.
• Right to data portability in a structured, machine-readable format.
• Right to lodge a complaint with the Nigeria Data Protection Commission (https://ndpc.gov.ng).

12Account deletion procedure

You may permanently delete your account in the mobile app via Profile → Security & Settings → Delete Account, or by sending a verifiable deletion request to support@myrentilly.com. Once verified and any outstanding escrow obligations are settled, all non-statutory data is irreversibly anonymized or deleted.

13Revisions to this policy

We may update this Privacy Policy to reflect technological, operational or statutory changes. Material updates are communicated through push notifications, in-app banners or email at least fourteen (14) days before they take effect.