Privacy Policy

YangaLandlord Limited (RC 9568033) decides how and why personal data is used in the services, and is the data controller under the Nigeria Data Protection Act 2023.

To ask about your data or to exercise a right in section 7, write to Data Protection Officer, YangaLandlord Limited, legal@yangalandlord.com.

Landlords and their team: name, phone number or e-mail address, the type of business, properties with their addresses and map position, units and tenancies, bank account details for rent payouts (the account number, bank code and account name encrypted), a signature image if you set one up, your recovery contact and the answers to your security questions (stored as one-way hashes), the team members you invite and what you let them do.

Tenants: name, phone number, e-mail address, the ID document type and number recorded on your tenancy, your tenancy and rent records, receipts, your recovery security questions (hashed), address certificates you buy, and move-in or move-out reports with their photographs and the location the photographs were taken.

Digital Property Agents: name, phone number or e-mail address, State, bank account details for payouts (the account number and bank code on your profile encrypted; each payout request keeps its own record of the account it was paid to), your referral code, your referrals and rewards, and the result of the DPA quiz.

People who verify a document: the reference code looked up, the e-mail address you verify from, and the message and e-mail address you give when you send an enquiry.

Everyone: the messages we send you and whether they were delivered, support requests you make in the product, and security records (the time, IP address and device description of sign-ins, bank changes, number changes and other sensitive actions).

In your browser we keep your sign-in session (and, for our staff, the admin sign-in), choices you have made in the product, a draft of the set-up wizard if you leave it part-way, the country detected from your connection (so we can show the right sign-in), and, when you arrive from a Yanga Moments card, which card brought you. We use no advertising or analytics trackers.

• To provide the services you have asked for: your account, tenancies, documents, payments, receipts, certificates and verification. Basis: performance of our contract with you.
• To meet legal duties: statutory notices that follow State tenancy rules, financial and tax records, responding to lawful requests. Basis: legal obligation.
• To keep the services safe: one-time codes, the number-change hold, fraud and abuse prevention, security records, and making a Yanga Moments card from a milestone before you decide whether to share it (the card is private until you share it and you can remove it). Basis: our legitimate interests, weighed against yours.
• To send Yanga Moments messages: only with your consent, which you can withdraw at any time with the stop link in every Moments message or in your Moments settings. Service messages (codes, notices, receipts, reminders) reach you on WhatsApp, SMS or e-mail as part of the contract.

We make no decisions about you by automated means that have a legal or similarly significant effect. The design of campaign cards uses an AI model, which receives a brief and never your personal data.

Inside a tenancy: a landlord and the team members they have authorised see the tenancy, the tenant's name and contact details, and the records of that tenancy; a tenant sees the landlord's name and business details, the agreement, the notices, the receipts and the name and title of any team member acting for the landlord. Bank details are never shown to the other side.

Verification: a person who verifies a document or certificate sees only the fields printed on it.

Referrals: a landlord who signs up with a Digital Property Agent's code sees the agent's name and contact details so they can confirm the agent. Where the code belongs to a tenant who has not completed the DPA quiz, the landlord sees the first name only.

Our processors, who act on our instructions and may not use your data for their own purposes: Amazon Web Services (hosting, storage, e-mail delivery, and the AI model used for campaign card designs), Cloudflare (the websites, domain and e-mail routing, and detecting your country from your connection), Paystack and Flutterwave (payments and payouts), Termii (SMS), Twilio and Meta (WhatsApp), and the e-signature service we run on our own infrastructure.

We do not sell personal data. We share it with others only where the law requires, to protect the rights and safety of people, or with your consent.

Your data is stored on Amazon Web Services in Ireland, with a backup copy of stored files in London. Some of our processors (Amazon Web Services, Cloudflare, Twilio and Meta, and the AI model provider through Amazon Web Services) handle data outside Nigeria. For each of them we rely on contractual terms that require protection at least equal to that required by the Nigeria Data Protection Act, and we transfer only what the processing needs.

• Tenancy agreements, statutory notices, move reports and signatures: 12 years after the tenancy ends, the period in which a claim about a tenancy can still be brought.
• Rent, payment, fee and payout records: 6 years after the payment, for financial and tax law.
• Security and audit records: 2 years.
• Yanga Moments cards: until you remove them, or your account closes.
• Address certificates: for their validity period plus the window in which they can be disputed.
• Everything else: while your account is open, and 90 days after it closes, unless a record above still applies.
• Drafts and choices kept in your browser: until you clear them or sign out.

When a period ends we delete the data or strip it of anything that identifies you.

Under the Nigeria Data Protection Act you may ask us for a copy of your personal data; to correct it; to delete it (except records we must keep under section 6); to restrict or object to a use of it; to receive data you gave us in a portable form; and to withdraw a consent you gave, which does not affect what was done before you withdrew it.

To use a right, write to legal@yangalandlord.com from the e-mail address or phone number on your account, or ask in the product. We answer within the time the Act allows and we may ask you to confirm it is you.

If you are not satisfied with our answer you may complain to the Nigeria Data Protection Commission.

The bank details on a landlord's and an agent's profile are encrypted where they are stored. Landlords and agents sign in with one-time codes; a tenant's password is stored as a one-way hash. A change of phone number starts a hold before bank details can be changed, and a transaction PIN protects those changes. Team members see only the properties and actions the landlord has allowed. Sensitive actions leave a security record. Data moves between you and us over encrypted connections.

If a breach of security affects your personal data in a way that is likely to put you at risk, we will tell the Nigeria Data Protection Commission within the time the Act requires and tell you without undue delay, with what happened and what you can do.

The services are for adults and are not directed at anyone under 18. If we learn that an account belongs to a child, we close it and delete the data, except any record the law requires us to keep.

We may update this policy. The date at the top shows the current version. For a change that affects how we use your data we will tell you in the product or by message before it takes effect.