Data Protection Policy

1. Data Controller

The data controller for this platform is the NexieRE Team, operating at nexiere.name.ng. Contact: privacy@nexiere.name.ng

2. Categories of Personal Data Processed

• Identification data: Full name, job title
• Organisational data: Company name, type, size, state
• Contact data: Email address, phone number
• Research data: Survey conversation transcripts and AI-generated insights
• Technical data: IP address, session identifiers (for security only)

3. Legal Basis for Processing (NDPA Section 25)

• Consent (s.25(1)(a)): Explicit consent given during email verification before survey participation
• Legitimate interests (s.25(1)(f)): Conducting industry research in the public interest of the Nigerian real estate sector
• Legal obligation (s.25(1)(c)): Where required by Nigerian law

4. Data Minimisation

We collect only the minimum data necessary to achieve our stated research objectives. We do not collect sensitive personal data (race, religion, health, political opinions, biometric data) as defined under the NDPA.

5. Cross-Border Data Transfers

Your survey responses are processed by our AI system to generate structured insights. All processing is conducted in accordance with applicable data protection standards. No unnecessary cross-border data transfers occur. All data is stored on secure servers.

6. Data Retention Schedule

• Registration and contact data: 3 years from collection date
• Survey transcripts and insights: 3 years from survey completion
• Email verification codes: Automatically deleted within 10 minutes
• Security logs (IP, rate limit records): 90 days
• Coming soon email list: Until launch + 30 days

7. Data Subject Rights Under the NDPA 2023

• Right of access (s.34): Obtain confirmation of whether we process your data and receive a copy
• Right to rectification (s.35): Correct inaccurate or incomplete data
• Right to erasure (s.36): Request deletion where there is no overriding legitimate reason to retain
• Right to restriction (s.37): Restrict processing in certain circumstances
• Right to portability (s.38): Receive your data in a structured, machine-readable format
• Right to object (s.39): Object to processing based on legitimate interests
• Right to withdraw consent (s.33): At any time, without penalty

Submit requests to: privacy@nexiere.name.ng. We respond within 30 days.

8. Security Measures

• All data transmitted over HTTPS (TLS 1.2+)
• Database credentials stored outside the web root
• Admin access protected by session auth, bcrypt passwords, and brute-force lockout
• SQL injection prevention via PDO prepared statements
• XSS prevention via output escaping
• Rate limiting on all API endpoints
• Session cookies marked HttpOnly, Secure, and SameSite=Strict

9. Breach Notification

In the event of a personal data breach, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by the NDPA 2023. Affected data subjects will be notified without undue delay where the breach is likely to result in high risk to their rights.

10. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with:

Nigeria Data Protection Commission (NDPC)
Website: ndpc.gov.ng
Email: info@ndpc.gov.ng