Privacy Policy

MAKAO TECHNOLOGIES LTD RC 9819245 · TIN 2622457252640 12/14 Oladipo Ige Close, Alimosho, Lagos State, Nigeria

Last updated: [DATE] · Effective: [DATE]

---

1. What this policy is

Makao runs a platform for property transactions — renting, leasing, short stays, serviced apartments, and buying and selling property. To do that, we handle personal information about the people who use it.

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and what you can tell us to do about it.

We are the data controller for the information described here. That means we decide what is collected and why, and we are answerable for it under the Nigeria Data Protection Act 2023.

2. Who this policy covers

You are covered by this policy if you are:

• Someone looking for a property — to rent, lease, stay in, or buy. We call this role a seeker.
• Someone who owns a property listed on the platform. We call this role an owner.
• Someone acting for an owner — a property management company, or a lawyer working on a transaction. We call this role a delegate.

These are roles in a transaction, not labels on a person. The same person can be a seeker on one deal and an owner on another.

You are also covered if you are:

• A director of a company that uses Makao. See section 4 — the short answer is that we do not hold your details.
• A guarantor named on an application.
• A contractor carrying out maintenance work.

3. What we collect

When you register Your name, email address and phone number. A password, which we store scrambled so that nobody — including us — can read it back.

When we verify who you are Your National Identification Number (NIN), your date of birth, and a photograph of your face. Sometimes a photograph of an identity document.

We also ask you to look at your camera for a few seconds. This checks that a real person is there and not a photograph or a video of you, so that nobody can pretend to be you. Those few seconds of video go straight from your phone to the company that does the check — they never reach our computers, and that company does not keep them.

If the check passes, that company gives us one still picture taken from it. We keep that picture, because it is what your NIN is matched against and it is the record that the check was done. If the check does not pass, we are given no picture at all.

We do this because property transactions carry real risk on both sides. A seeker can be defrauded by someone who does not own the property. An owner can hand over possession, or title, to someone whose identity cannot be established. Checking identity against the official register is how we reduce both.

When we verify your address Your residential address, and the result of the check.

When you list, search for, or apply for a property Property addresses, listing details, photographs and documents. What you searched for. Applications you made, including ones that were turned down or that you withdrew.

When you enter an agreement The terms, the signed document, and the names and email addresses of everyone who signed.

When money moves Bank account details, payment authorisations, payment history, and how funds were split at settlement. Makao never holds your money and never opens a bank account for you. You tell us which of your own bank accounts to use, we check with your bank that the account really is yours, and money goes straight there.

While you use the platform Which device you are using, and information that identifies that device so we can spot someone else trying to sign in as you. Messages you send other parties through the platform. Maintenance requests, claims and disputes.

Always A record of what happened and when — who did what, and to which record. We are required to keep this.

4. If you are a company director

We do not hold your details.

When a company uses Makao we check the company itself — its registration number, name, type, status and registered address — against the Corporate Affairs Commission register. The provider that runs that check also sends back the names of the company's directors and owners. We do not read those, we do not store them, and we do not use them. They are discarded the moment the answer arrives.

If that ever changes we will say so here before it does, and we will set out where the information came from and what we use it for.

If you want to know what we hold about you, contact us at section 10. We will respond whether or not you have an account with us.

5. Why we are allowed to do this

What we do	Why we are allowed to
Run your account, process your transaction, collect payment	Because we need to, to do what you asked us to do — the contract between us
Check your identity and address; keep those records	Because the law requires us to know who our users are and to keep those records
Protect the platform from fraud and unauthorised access; keep audit records	Because we and our users have a genuine interest in the platform being safe
Send you optional messages; use non-essential tracking	Only if you agree, and you can change your mind at any time

One thing we want to be straight about. We do not treat identity verification as something you "consented" to. If you need a property, and we tell you that verification is required before you can apply, you are not really in a position to say no. Calling that consent would be dishonest. We rely on the law instead, because checking who our users are is something we are required to do — and where a check is needed to set up or carry out our contract with you, we rely on that contract for that check. Either way it means we have to justify it, which is the stricter test.

6. Who we share it with

We use other companies to do specific jobs. They may only use your information for that job.

What they do	Who
Check identity, address and company records	Prembly, SmileID
Check that it is a real face in front of the camera, not a photograph	Microsoft, Amazon
Move money between bank accounts	Paystack, Kora, Paga
Send messages	Termii (SMS), Resend (email), Firebase Cloud Messaging (push)
Handle electronic signatures	BlueInk, BoldSign
Maps and address lookup; sign-in with Google	Google, Mapbox
Store documents and images	Cloudflare
Run our systems	OVHcloud

We also share information with the other party to your transaction, to the extent they need it to deal with you — an owner sees enough about a seeker to decide on an application, and the other way round.

We do not sell your information. We do not share it for advertising.

7. Whether your information leaves Nigeria

Some of it does, and we want to be specific about which.

Checked in Nigeria. Every company that sees your NIN or your bank details operates in Nigeria. None of those checks or payments is handled from outside the country.

Stored outside Nigeria. Our own systems are not in Nigeria, so once a check is done, what we keep as a result of it — including your NIN — is held on our servers abroad, described next.

Goes to the European Union. Our systems run on servers in the EU, and documents and images are stored there. The camera check described in section 3 is also done in Europe. The EU has data protection law comparable to Nigeria's, with an independent regulator and rights you can enforce — and those rights apply to you whether or not you are a European citizen. About the camera check. The companies we use for it operate in Ireland, so those few seconds of video leave the country. We thought about dropping the check to keep everything closer to home, and decided not to: without it, someone holding a photograph of you could pretend to be you. Instead we made the trip as short as we could — the video goes from your phone straight to the company doing the check and never passes through us, neither company keeps it, and we have switched off the setting that would otherwise let them use anything from these checks to improve their own software. The one still picture described in section 3 is the only thing kept, and we keep it, not them.

Goes to the United States. Maps and address lookup, email and push notifications, and electronic signatures. We keep this to the minimum: address text rather than identity records, and never your identity documents or photographs. US privacy law is weaker than Nigeria's and does not give non-citizens the same protections, so we rely on written contracts with those companies instead.

8. How long we keep it

What	How long	Why
Identity and address verification records	5 years after our relationship with you ends	Required by anti-money-laundering rules
Payment, settlement and transaction records	6 years	Required by tax and company law, and by anti-money-laundering rules for 5 years after each transaction completes
Agreements and deal records	6 years after the agreement ends	Not a legal requirement to keep them. We keep the records that would answer a dispute for as long as one can still be brought
Records of a change of property ownership	12 years	Claims over land can be brought for longer. We keep the transfer record and who the parties were, not the whole file
Applications that were turned down or withdrawn	12 months	Short — no transaction followed
Technical records of your devices and sessions	12 months	Security
Records of calls to our verification and payment partners	5 years	Fraud investigation and audit

We do not delete rows from our systems. That is deliberate: a financial record with holes in it is not a financial record. What we do instead, when a retention period ends or you ask us to erase you, is destroy the link between the record and you — we remove your name, contact details and identifiers, so the record still balances but no longer identifies anyone.

Where the law requires us to keep something, we keep it. In that case we will normally erase the parts we are not required to keep and tell you what we kept and why.

9. What you can tell us to do

You can ask us to:

• Show you what we hold about you.
• Correct anything wrong.
• Delete your information — subject to section 8, where the law requires us to keep some of it.
• Give you a copy in a format you can take elsewhere.
• Stop or limit what we are doing with it.
• Withdraw your agreement to anything you agreed to, at any time.

You can download a copy of your information yourself, at any time, from your account — you do not need to ask us, and there is no charge. It arrives as a structured file you can take elsewhere, and it includes an explanation of why we hold each category.

For anything else, ask by contacting us at section 10. We will respond within 30 days. If a request is complex we may need longer, in which case we will tell you within those 30 days, explain why, and give you a date.

If it is urgent, say so. If a wrong record is blocking a property application, that is time-critical and we will treat it that way.

If we get it wrong, you can complain to us first, and we will explain what we did and why. You also have the right to complain directly to the Nigeria Data Protection Commission, whether or not you complain to us first. You do not need our permission and we will not treat you differently for doing it.

10. How to reach us

Data Protection Officer: Olasoji Ige — [email protected] · +234 905 070 9176

MAKAO TECHNOLOGIES LTD 12/14 Oladipo Ige Close, Alimosho, Lagos State, Nigeria [email protected] · +234 905 070 9176

Nigeria Data Protection Commission — ndpc.gov.ng

11. Changes to this policy

If we change how we handle your information, we will update this policy and tell you before the change takes effect. The date at the top shows when it last changed.