Privacy Policy

Zuba is run by ZUBA PROPTECH LIMITED, a company registered in Nigeria. For the purposes of the Nigeria Data Protection Act 2023 (NDPA), we are the data controller for the personal information described in this policy.

If you have a question about your information, or want to use any of your rights, email privacy@zuba.ng. That inbox is read by the people responsible for data protection at Zuba.

When you create an account

• Your name, email address and phone number.
• Your password, if you sign up with email. If you sign in with Google instead, Google shares your name, email address and profile photo with us. We never see your Google password.
• Whether you are looking for property or listing it.

When you become an agent

• Your full name as it appears on your ID, your phone number and the state you work in.
• Your professional association (for example ERCAAN) and your membership number.
• Your agency name, logo, profile photo, bio and the areas you cover, if you add them.
• For higher verification tiers: a government-issued ID, your CAC registration details and a selfie. Our verification team looks at the selfie next to your ID to confirm the ID is yours.

When you list a property

• The address, the pin you drop on the map, photos, price, description and features of the property.

When you contact someone

• Enquiries and viewing requests you send to an agent, and messages you send to our support team.
• When you tap WhatsApp or Call on a listing, we record the tap, and which listing it was on, in our analytics, so we can tell which listings bring enquiries.
• Receipts that agents create on Zuba, which contain the name of the person paying, the amount and the property. Anyone holding a receipt can check it is genuine on zuba.ng. That check shows the agent, the amount, the date and the property address, but not the payer’s name.

When you use the site

• The pages you visit, the searches you run, the device and browser you use, your rough location (city level, worked out from your IP address) and the site that sent you to us.
• We remove sign-in codes and tokens from page addresses before they reach our analytics tools.

We do not collect card or bank details. Zuba does not take payments.

The Tenant Registry lets verified agents record and check a tenant’s history before a new tenancy, for example unpaid rent or damage to a property. It means Zuba holds information about tenants who may never have used Zuba themselves.

A report can include the tenant’s name, phone number, email address, National Identification Number (NIN), the address of the property, its state and LGA, a description of what happened, and up to six photos or PDF files as evidence. Agents can also record that a tenant was good, not only flag problems.

Who can see it: verified agents who are signed in. Reports are not public.

Why we hold it: landlords and agents have a legitimate interest in knowing whether a prospective tenant has a record of serious problems, and tenants with a good record benefit from being vouched for. We weigh that interest against the tenant’s rights, which is why access is limited and every report can be disputed.

If a report is about you: you have the right to know what it says, to correct it if it is wrong and to ask us to remove it. Email privacy@zuba.ng with your name and the phone number or NIN the report would be filed under. We will review the report, ask the agent who filed it for their side, and correct or remove anything that is inaccurate or that we cannot support.

Agents who file false or malicious reports lose access to the registry and may lose their account.

The NDPA says we need a lawful basis for each use of your information. Here is what we do and the basis we rely on.

We do not use your information to make decisions about you that are fully automated and have a legal or similarly serious effect.

The public

Agent profiles (name, photo, agency, association, areas covered and verification status) and listings are visible to anyone, along with the phone number the agent takes enquiries on, so visitors can call or message them.

Agents you contact

When you send an enquiry or request a viewing, the agent receives the details you include, such as your name and phone number.

Companies that help us run Zuba

They act on our instructions and may only use your information to provide their service to us.

• Vercel hosts the website.
• Cloudflare stores the photos and documents uploaded to Zuba.
• Google provides Sign in with Google and Google Analytics.
• PostHog provides product analytics, on servers in the EU.
• WhatsApp (Meta) receives your number only when you choose to message an agent there.
• OpenStreetMap supplies the map images on listings. Your browser fetches them directly, so OpenStreetMap sees your IP address.

When the law requires it

We share information with the police, courts or regulators when the law requires us to, and we may report agents who submit fraudulent documents to their professional association.

If Zuba changes hands

If Zuba is merged, sold or reorganised, your information may pass to the new owner, who must keep to this policy.

We never sell your personal information, and we do not share it with advertisers.

Some of the companies listed above store or process information outside Nigeria, including in the European Union and the United States. When that happens we rely on the safeguards the NDPA allows, such as the provider’s contractual commitments to protect the data to a standard at least as high as Nigerian law.

• Your account: for as long as you have one. When you close it, we delete or anonymise your information unless we have to keep part of it for a legal reason, such as an open fraud report.
• Agent verification documents: while you are a verified agent, and for a short period after, so we can show how a badge was granted if it is ever challenged.
• Tenant Registry reports: while they are still relevant to tenant screening. A report that is disputed and found to be wrong is removed straight away.
• Analytics data: for a limited period set in each analytics tool, after which it is deleted automatically.

Backups are overwritten on a rolling basis, so deleted information can take a little longer to disappear from them. Until it does, it is not used for anything.

Zuba runs over HTTPS only. Your sign-in tokens are kept in cookies that the page’s own scripts cannot read, which protects them from many common attacks. Verification documents and Tenant Registry evidence are only shown to the people who need them, and our staff can only reach personal information when their work requires it.

No system is perfectly secure. If we ever have a breach that puts your information at risk, we will tell the Nigeria Data Protection Commission and, where the law requires it, tell you. If you find a security problem, please report it to security@zuba.ng.

Under the NDPA you have the right to:

• See the personal information we hold about you and get a copy.
• Correct it if it is wrong or incomplete. You can change most account details yourself in your profile settings.
• Delete it, or close your account.
• Restrict how we use it while a complaint is looked into.
• Object to us using it on the basis of legitimate interests, including in the Tenant Registry.
• Take it with you in a common format, for information you gave us.
• Withdraw consent at any time, where we rely on it. This does not affect what we did before.

To use any of these rights, email privacy@zuba.ng from the address on your account, or tell us how to reach you if you do not have one. We may ask you to confirm who you are before acting. We aim to respond within 30 days and we do not charge for it.

If you are not happy with how we handled your request, you can complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Zuba is for adults. You must be 18 or older to create an account. If we learn that someone under 18 has given us personal information, we will delete it.

We use a small number of cookies to keep you signed in and to understand how the site is used. Our Cookie Policy lists every one of them and explains how to turn them off.

When we change this policy we will update the date at the top of the page. If a change affects how we use information you have already given us, we will tell you by email or with a notice on Zuba before it takes effect.

Questions about privacy: privacy@zuba.ng. Anything else: support@zuba.ng.