Privacy Notice
This notice explains what personal data NigeriaServe collects when you search for, book or manage a stay, how we use it, who we share it with, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA) and the NDPA General Application and Implementation Directive 2025 (GAID).
1. Who we are
nigeriaserve.com/ is operated by Omega Training Limited (RC 1753408), registered at 22 Faulks Road, Aba, Abia State, Nigeria (“NigeriaServe”, “we”, “us”). For bookings made through our website, apps and customer service, we are the data controller of your personal data.
The hotels, apartments and guesthouses you book (“accommodation providers”) are separate data controllers for the data they receive to host you. So are our booking partners when you book a stay they supply, as explained in section 4.
Data Protection Officer: Ndidi Pat, hello@nigeriaserve.com, +234 809 448 2255 (phone and WhatsApp). Contact our DPO about anything in this notice or to exercise your rights.
This notice covers guests and anyone booking for others, visitors to our website, people who contact us, and the staff of accommodation providers who list with us. It does not cover the websites of third parties we link to.
2. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Booking details | Name, email, phone or WhatsApp number, number of guests, dates, room choice, special requests | You, when you book |
| Other guests | Names of people you book for | You. Tell them you are sharing their details |
| Payment data | Amount, currency, payment method, transaction reference, refund records | You and our payment providers. We do not store full card numbers |
| Account and support | Booking references, messages, call or chat records, complaints, reviews | You |
| Technical data | IP address, device and browser type, pages viewed, searches, approximate location from IP | Your device, through cookies and server logs |
| Partner data | Names, phone numbers and emails of hotel owners and staff, bank details for payouts | Accommodation providers who list with us |
| Fraud and safety signals | Unusual payment patterns, chargeback history | Payment providers and our own checks |
Sensitive personal data. We do not ask for health, religious or other sensitive data. If you choose to share it in a special request (for example, an accessibility need), we use it only to pass the request to your accommodation provider, with your consent.
If you do not give us the details we need to make a booking, we cannot complete it.
3. How we use your data and why we are allowed to
The NDPA lets us process personal data only where a lawful basis applies. This table sets out each use and its basis.
| What we do | Lawful basis under the NDPA |
|---|---|
| Search availability, make, change and cancel your booking, and send confirmations | Contract with you |
| Take payment, issue refunds and keep payment records | Contract; legal obligation (tax and accounting records) |
| Customer service, including WhatsApp, phone and email support | Contract; legitimate interests in resolving issues |
| Prevent fraud, chargebacks and misuse of the platform | Legitimate interests; legal obligation |
| Improve search results, prices shown and the website | Legitimate interests (we assess these against your rights) |
| Send booking-related messages such as reminders and check-in details | Contract |
| Send offers and newsletters | Consent only, which you can withdraw at any time |
| Pass on an accessibility or health-related request | Your explicit consent |
| Respond to courts, regulators and law enforcement | Legal obligation |
Where we rely on legitimate interests, we carry out a documented Legitimate Interest Assessment as the GAID requires. You can ask our DPO for a summary.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our fraud checks may flag a payment for review, but a person makes the final decision.
4. Who we share your data with
We share only what each recipient needs. We do not sell your personal data.
- Your accommodation provider. Your name, contact details, dates, guests and requests, so they can host you.
- Booking partners. Some stays are supplied by partners such as Hotelbeds or Expedia Group. When you book one of these, we send them the details needed to secure your room. Some offers send you to Booking.com to complete the booking there; Booking.com’s own privacy notice then applies.
- Payment providers. Paystack, Stripe, PayPal and our bank process your payment under their own security standards and legal duties.
- Service providers acting for us. Web hosting, email and messaging (including WhatsApp), customer support tools and analytics. They process data only on our written instructions, under contracts the NDPA requires.
- Professional advisers and auditors, under confidentiality.
- Authorities. Courts, the Nigeria Data Protection Commission (NDPC), the police and other bodies where the law requires it.
- A buyer or successor if our business is sold or restructured, subject to this notice.
[Add or remove partners to match the booking engines and tools you actually switch on.]
5. International transfers
Booking a stay outside Nigeria, or using an international payment method, means your data goes to recipients in other countries. Some of our service providers also store data abroad.
We transfer personal data out of Nigeria only on a basis the NDPA allows: an adequacy decision by the NDPC, a Cross-Border Data Transfer Instrument approved by the NDPC (such as standard contractual clauses), or another ground in the Act. The main one for bookings is that the transfer is necessary to perform your contract, for example to send your booking to a hotel in Accra. Ask our DPO for details of the safeguards used.
6. How long we keep your data
| Data | How long |
|---|---|
| Booking and payment records | 2 years after the stay, for tax and accounting |
| Customer service records and complaints | 2 years after the matter closes |
| Marketing preferences | Until you unsubscribe, then a suppression record so we do not contact you again |
| Technical logs and analytics | 2 years |
| Partner records | For the partnership, then 2 years |
After these periods we delete or anonymise the data, unless a legal claim or investigation needs it kept longer.
7. How we protect your data
We use encryption in transit (HTTPS), access controls limited to staff who need the data, secure payment pages run by our payment providers, regular backups and staff training. If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it. If the risk to you is high, we will tell you directly, in plain language, with steps you can take.
8. Cookies and similar technologies
We use small files and browser storage to run the site and understand how it is used.
| Type | What it does | Can you refuse it? |
|---|---|---|
| Essential | Keeps search results, your booking session, payment pages and security working | No, the site cannot work without them |
| Preferences | Remembers your currency and the guest details you entered | Yes, in your browser settings |
| Analytics | Counts visits and shows which pages work, so we can improve them | Yes, through our cookie banner [add one before using analytics] |
| Advertising | Measures adverts on other sites | Yes; we only use these with your consent |
9. Marketing
We send offers and newsletters only if you agree. Every message has an unsubscribe link, and you can also reply STOP to WhatsApp or SMS messages, or email hello@nigeriaserve.com. Booking confirmations and service messages are not marketing and will still be sent.
10. Children
Our services are for adults. You must be 18 or older to make a booking. We do not knowingly collect data directly from children. When a parent or guardian books for a family, the child’s name is used only to make that booking.
11. Your rights
Under the NDPA you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data where we no longer need it or have no lawful basis to keep it;
- restrict how we use it while a concern is resolved;
- send your data to you or another organisation in a commonly used format (portability);
- stop using it for direct marketing, or for purposes based on our legitimate interests, unless we have compelling grounds;
- withdraw any consent you gave, without affecting what we did before you withdrew it.
Email hello@nigeriaserve.com with your request and booking reference. We may ask you to confirm your identity. We will respond within 30 days and will not charge you, unless a request is clearly unfounded or excessive.
12. Complaints
If you are unhappy with how we handle your data, contact our DPO first so we can try to put it right. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng). If you live outside Nigeria, you may also contact the data protection authority where you live.
13. Changes to this notice
We will update this notice when our services or the law change. The date at the top shows the latest version. We will tell you about significant changes by email or on the website before they take effect.