This Privacy and Cookies Policy (the “Policy”) applies to personal data collected and processed through the https://jodoaproperties.com/ng/ website (the “Website”).

The Website is owned and operated by Jodoa Properties Ltd and its subsidiaries (“Jodoa”, “Company”, “we”, “us”, or “our”), a limited liability company registered in the Federal Republic of Nigeria under registration number 1585606. Our registered office is:

Jodoa Properties Ltd,
Oakland Centre, 48 Aguiyi Ironsi St,
Maitama, Abuja 904101,
Federal Capital Territory, Nigeria.

Jodoa is committed to protecting the privacy of visitors to our Website and users of our real estate services.

This Policy explains how we collect, use, disclose, retain, and protect personal data in line with the Nigerian Data Protection Act 2023 (NDPA 2023) and other applicable laws in Nigeria.

This Policy applies only to data collected through the Website and does not apply to third-party websites or services that may be linked from it.

We collect and process personal data supplied directly by you, as well as information generated automatically through your interaction with the Website.

2.1 Voluntarily Provided Information

• Contact and Identity Details: Full legal name, address, telephone number, email address, date of birth, gender, and nationality.
• Transactional and Financial Information: Billing address, payment verification details, property preferences, saved listings, order histories, and incomplete transactions or discarded baskets.
• Survey and Feedback Data: Information provided through online or offline customer surveys, feedback forms, and enquiries.

2.2 Automatically Collected Information

• Technical and Statistical Data: IP address, domain type, geographic location, browser type and version, device operating system, unique device fingerprints, and referring URLs.
• Usage Data: Explicit details of your journey through the Website, including page views, search queries, items clicked, and the exact timestamps of your visits.

Jodoa processes personal data only where a valid lawful basis applies under the NDPA 2023. Depending on the activity, this may include performance of a contract, compliance with a legal obligation, legitimate interests, or consent where required. The main processing activities and corresponding lawful bases are set out below.

• We process contact and identity details to register accounts, verify identity, and deliver our core real estate services on the lawful basis of performance of a contract.
• We process billing and transactional information to complete property transactions, issue invoices, and manage payments on the lawful basis of performance of a contract.
• We process contact, technical, and service-related information to provide technical support, maintain system availability, and send important service communications on the lawful bases of performance of a contract and legitimate interests.
• We process technical, statistical, and usage data to improve website functionality, user experience, and business operations on the lawful basis of legitimate interests.
• We process identity, technical, and transactional data to prevent fraud, protect assets, and maintain security on the lawful bases of legitimate interests and legal obligation.
• We process contact details and marketing preferences to send newsletters, promotions, and marketing communications only where you have given consent.

We process identity, transactional, and tax-related information to comply with regulatory, law enforcement, and statutory reporting obligations on the lawful basis of legal obligation.

Jodoa retains personal data only for as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by applicable law, regulation, lawful request, litigation hold, or dispute resolution requirement. Subject to those overriding requirements, we generally retain contact and enquiry records for up to 3 years after the last meaningful interaction; account, identity verification, and customer relationship records for up to 7 years after the end of the business relationship; transactional, billing, and payment verification records for up to 7 years after the relevant transaction; technical logs, security monitoring data, and usage analytics for up to 12 months unless required for investigation, fraud prevention, or security purposes; and marketing consent or suppression records for up to 5 years from withdrawal of consent or the last marketing interaction.

The criteria utilised to determine our retention periods include:

• The duration of your active contractual or business relationship with Jodoa.
• The existence of ongoing legal proceedings or anticipated dispute resolutions.
• Statutory limitation periods under Nigerian law for corporate, tax, and real estate transactions (typically ranging from 6 to 7 years post-transaction).
• Whether the data is required in an anonymised format for long-term statistical analysis, in which case all identifying attributes are permanently removed.

5.1 Marketing Communications

Marketing communications regarding our products, services, and investment opportunities will only be transmitted via mobile messaging, post, or email if you have provided explicit, opt-in consent during registration or initial engagement.

5.2 How to Withdraw Consent

You may withdraw your consent to direct marketing or any other consent-based processing at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Consent may be revoked through the following mechanisms:

• Utilising the “Unsubscribe” hyperlink embedded at the footer of all electronic marketing correspondence.
• Adjusting your account communication preferences directly within your online user portal.

Submitting a formal revocation request via email to our designated privacy office at info@jodoaproperties.com.

We do not sell, rent, or lease your personal data. We share personal data only with selected categories of recipients where necessary, under appropriate safeguards and on a valid lawful basis.

• Financial and Payment Partners: Full payment card details are captured directly by certified, legally authorised third-party payment gateways. These details are never stored on Jodoa servers and are not accessible to Jodoa staff. Such disclosures are made on the lawful basis of performance of a contract and, where applicable, legal obligation.
• Service Providers and Corporate Vendors: Trusted technical partners, IT hosting providers, cloud storage operators, and marketing infrastructure providers who process data only under our instructions. Such disclosures are made on the lawful bases of performance of a contract, legitimate interests, and consent where marketing-related processing depends on prior opt-in.
• Professional Advisers: Legal counsel, financial auditors, risk managers, and insurance underwriters, where necessary for compliance, risk management, or corporate governance. Such disclosures are made on the lawful bases of legitimate interests and legal obligation, as applicable.
• Corporate Successors: Prospective purchasers, investors, or assignees in the event of a partial or complete corporate restructuring, merger, or asset sale. Such disclosures are made on the lawful basis of legitimate interests and, where necessary, for steps connected with the performance or continuation of a contract.
• Regulatory and Judicial Authorities: Law enforcement agencies, statutory regulators, government ministries, or municipal bodies within Nigeria, strictly where disclosure is required by law. Such disclosures are made on the lawful basis of legal obligation.

Jodoa may transfer, store, or process personal data outside Nigeria where this is necessary for service delivery, group operations, cloud hosting, technical support, or other legitimate business purposes.

Where personal data is transferred outside Nigeria, Jodoa will ensure that the transfer is made in accordance with the Nigeria Data Protection Act 2023 and any applicable guidance or directives issued by the Nigeria Data Protection Commission (NDPC). Depending on the circumstances, this may include reliance on an adequacy decision, appropriate contractual safeguards, binding corporate rules, or any other lawful transfer mechanism recognised under applicable law.

• Adequacy Decisions: Transferring to countries recognised by the Nigeria Data Protection Commission (NDPC) as maintaining an adequate level of data protection.
• Standard Contractual Clauses (SCCs): Implementing robust data transfer agreements containing standard protection clauses approved by the NDPC to guarantee that recipients protect your information with the same rigour required under Nigerian law.
• Binding Corporate Rules: Ensuring internal cross-border corporate sharing aligns with globally verified security frameworks.

Our Website uses cookies and similar technologies to support core functionality, improve performance, remember your preferences, and, where applicable, support analytics and marketing activities. Some cookies are strictly necessary for the operation of the Website, while others are used only where permitted by applicable law and, where required, with your consent.

• Strictly Necessary Cookies: These cookies are required for core website functions, such as security, network management, session continuity, and access to essential features.
• Analytics Cookies: These cookies help us understand how visitors use the Website, measure performance, and improve functionality. Where required by applicable law, we will use these cookies only with your consent.
• Preference Cookies: These cookies remember choices you make, such as language, location, or display settings, to provide a more tailored experience.
• Advertising or Targeting Cookies: These cookies may be used to deliver more relevant promotions and to measure the effectiveness of marketing campaigns. Where required by applicable law, we will use these cookies only with your consent.
• Third-Party Cookies: Some cookies may be set by third-party service providers that support website functionality, analytics, advertising, fraud prevention, or security monitoring. Their use is subject to the relevant contractual and privacy safeguards.

You can manage cookies through your browser settings and, where available, through the cookie preferences tools presented on the Website. Please note that disabling strictly necessary cookies may affect the availability or functionality of parts of the Website.

Under the NDPA 2023, you have rights in relation to your personal data, subject to applicable legal conditions and exceptions.

• Right of Access: You may ask us to confirm whether we process your personal data and request a copy of the personal data we hold about you.
• Right to Rectification: You may ask us to correct personal data that is inaccurate, incomplete, or out of date.
• Right to Erasure: You may ask us to delete your personal data where there is no valid legal or contractual reason for us to continue processing it.
• Right to Object to Processing: You may object to processing based on our legitimate interests, including processing for direct marketing.
• Right to Restrict Processing: You may ask us to limit how we use your personal data in certain circumstances, including where accuracy or the legal basis for processing is disputed.
• Right to Data Portability: You may request your personal data in a structured, commonly used, and machine-readable format, or ask that it be transferred to another controller where applicable.
• Rights Related to Automated Decision-Making: You may object to decisions based solely on automated processing where those decisions have significant legal or similar effects, and you may request human review where applicable.
• Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before you withdrew consent.
• Right to Lodge a Complaint with the NDPC: You may lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) if you believe your rights under applicable data protection law have been infringed.

To exercise any of the rights listed above, you may submit a request to our privacy team using the contact details provided in Section 13. We may request information reasonably necessary to verify your identity before acting on your request, and we will respond in accordance with applicable legal requirements.

The services, property listings, and investment products offered on this Website are strictly intended for individuals who have attained the legal age of majority (18 years of age or older within the Federal Republic of Nigeria).

Jodoa does not knowingly solicit, collect, or process personal data from children or minors under the age of 18. If we identify that personal data belonging to a minor has been gathered via the Website without verified parental or legal guardian consent, immediate administrative protocols will be deployed to permanently delete the information from our servers and storage systems.

Jodoa uses administrative, technical, physical, and organisational measures designed to protect the confidentiality, integrity, and availability of personal data.

Our defensive framework includes:

• End-to-end encryption protocols (SSL/TLS) for data in transit and robust encryption standards for data at rest.
• Stringent internal access controls restricting data exposure exclusively to personnel who possess a verified business necessity.
• Continuous security education, privacy awareness coursework, and handling protocols for all operational staff.
• Systematic vulnerability assessments, firewall architectures, and active network monitoring to preempt cyber threats.

While we take reasonable steps to protect personal data, no method of transmission over the internet or electronic storage is completely secure. We encourage users to take appropriate precautions when using digital services.

12.1 Complaints to Jodoa

If you believe that your personal data has been processed in a manner inconsistent with this Policy or applicable data protection law, you may submit a complaint to Jodoa using the contact details set out in Section 13 so that the matter may be reviewed and, where appropriate, remedied internally.

12.2 Complaints to the NDPC

You may also lodge a complaint directly with the Nigeria Data Protection Commission (NDPC):

Nigeria Data Protection Commission (NDPC)
No. 5, Dr. Clement Isong Street,
Asokoro, Abuja,
Nigeria.
Website: https://ndpc.gov.ng

If you have any privacy questions, wish to exercise your data subject rights, or want to make a data protection complaint, please use the contact details below. Jodoa has designated a Data Protection Officer to oversee compliance with applicable data protection obligations and to act as a contact point for data subjects and relevant regulatory authorities.

• Attn: Head of Compliance
• Data Protection Officer (DPO): Vivian Ayegba
• Corporate Entity: Jodoa Properties Ltd
• Postal / Office Address: Oakland Centre, 48 Aguiyi Ironsi St, Maitama, Abuja 904101, Federal Capital Territory, Nigeria.
• Email: info@jodoaproperties.com
• General Enquiries: enquiries@jodoaproperties.com

Jodoa may update this Policy from time to time to reflect changes in our practices, technology, or legal obligations. Any updates will be reflected by revising the “Effective Date” at the beginning of this document. Where appropriate, we will provide additional notice of material changes through the Website or other suitable communication channels.