Privacy Policy

1. Data Controller

Dukiani is a product of Dukiani Digital Services Ltd (RC 9700361), the data controller, of Mulliner Towers, 39 Alfred Rewane Road, Ikoyi, Lagos 101233. Contact: hello@dukiani.com

2. Data We Collect

2.1 Information You Provide

• Registration data: full name, email address, phone number, role (Landlord/Tenant/Agent/Vendor), state and city;
• Identity verification: where required, NIN or BVN — collected via Paystack, not stored by Dukiani directly;
• Property data: address, unit details, rent amount, photos, amenities (Landlords and Agents);
• Tenancy data: lease terms, tenant employment information, guarantor details;
• Vendor profile data: business name, service categories (e.g. plumbing, electrical, painting), coverage areas, portfolio photos, professional certifications, and bank account details for payout purposes;
• Technician data: names, skills, certification documents, and availability schedules submitted by Vendors on behalf of their workers;
• Financial data: bank account details (stored by Paystack), payment history, subscription records;
• Communications: messages, maintenance requests, job notes, and support correspondence;
• Profile information: profile photo, professional certifications.

2.2 Information Collected Automatically

• Device and browser information: IP address, browser type, operating system;
• Usage data: pages visited, features used, timestamps of access, session duration;
• Cookies and similar technologies: see Section 9.

2.3 Information from Third Parties

• Paystack: payment confirmation data, transaction references, and bank account verification status;
• Supabase: authentication events and session data hosted on our behalf;
• Other Users: a Landlord may provide a Tenant's contact details to invite them to the Platform; a Landlord may submit a Vendor's contact details when assigning a Maintenance Job.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the NDPA:

• Contract performance: to provide and manage the Platform services you have requested;
• Legitimate interests: to improve the Platform, detect fraud, and ensure security;
• Legal obligation: to comply with Nigerian law, tax requirements, and regulatory obligations;
• Consent: for marketing communications (where you have opted in) and certain cookies.

4. How We Use Your Data

• Creating and managing your user account;
• Facilitating rent payments, subscription billing, and agent success fee collection;
• Processing tenancy applications and generating digital lease agreements;
• Matching Maintenance Jobs to appropriate Vendors based on service category and coverage area;
• Processing Maintenance Job payments via Paystack split payment and calculating the 10% Vendor commission deduction;
• Sending Vendors job assignment notifications, status updates, and completion confirmations;
• Displaying Vendor profiles, service areas, ratings, and job history to Landlords for job assignment decisions;
• Sending transactional notifications: rent reminders, payment confirmations, maintenance updates, job status alerts;
• Responding to your support queries and resolving disputes;
• Detecting and preventing fraud, money laundering, and other prohibited activities;
• Complying with Nigerian law including CAC annual returns and FIRS requirements;
• Sending marketing communications about new features, where you have consented;
• Generating anonymised, aggregated market intelligence reports.

5. Data Sharing

We do not sell your personal data. We may share your data with the following parties:

6. Data Retention

• Active account data: retained for the duration of your account and 2 years after closure;
• Payment records: retained for 7 years as required by Nigerian tax law (FIRS);
• Lease agreements and tenancy records: retained for 6 years from the end of the tenancy;
• Maintenance Job records: retained for 3 years from job completion;
• Support correspondence: retained for 3 years;
• Anonymised usage analytics: retained indefinitely.

7. Your Rights Under the NDPA

As a data subject, you have the following rights:

• Right of Access: request a copy of the personal data we hold about you;
• Right to Rectification: request correction of inaccurate or incomplete data;
• Right to Erasure: request deletion of your personal data (subject to legal retention obligations);
• Right to Restriction: request that we limit the processing of your data;
• Right to Data Portability: receive your data in a structured, machine-readable format;
• Right to Object: object to processing based on legitimate interests, including direct marketing;
• Right to Withdraw Consent: withdraw consent for marketing at any time.

To exercise any of these rights, contact hello@dukiani.com. We will respond within 14 days. You may also complain to the Nigeria Data Protection Commission (NDPC).

8. Data Security

We implement technical and organisational measures to protect your personal data, including:

• Encryption of data in transit using TLS/HTTPS;
• Encrypted storage on Supabase (PostgreSQL) with row-level security (RLS) policies;
• Access controls limiting data access to authorised Dukiani personnel only;
• Regular monitoring through UptimeRobot and Supabase audit logs;
• Paystack PCI-DSS compliance for all payment data.

In the event of a data breach posing risk to your rights, we will notify the NDPC within 72 hours and affected Users as soon as reasonably practicable.

9. Cookies

We use essential cookies for session management and authentication. We do not use third-party advertising cookies. You may disable non-essential cookies through your browser settings.

10. Children's Privacy

The Platform is not intended for persons under 18. We do not knowingly collect personal data from children. If we become aware that a child has registered, we will delete the account promptly.

11. International Data Transfers

Your data may be processed or stored outside Nigeria by our service providers (Supabase: USA/EU; Vercel: USA/EU; Resend: USA). International transfers are subject to adequate safeguards as required by the NDPA.

12. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified at least 14 days before they take effect. Continued use of the Platform constitutes acceptance of the updated Policy.