Privacy Policy

Kemchuta Homes Limited (“Kemchuta Homes”, “we”, “us” or “our”) is a real estate company incorporated in Nigeria. We market estates and plots, process plot subscriptions, arrange site inspections, run the Buy2Sell property investment scheme, and operate a network of independent realtors.

For the purposes of the Nigeria Data Protection Act 2023 (“NDPA”) and the regulations and directives issued under it, Kemchuta Homes is the data controller of the personal data described in this policy. Our contact details are in the Contact us section.

This policy applies to personal data we process through kemchutahomesltd.com and its subdomains (the “Website”), the Kemchuta Homes mobile app (the “App”), the client portal, the realtor and staff dashboards, and our AI chat assistant (together, our “Services”), and to the offline dealings connected to them — for example when you visit one of our offices, call us, or inspect an estate. It covers visitors, prospective and existing clients, subscribers, Buy2Sell investors, realtors, and the next of kin or spouses whose details are given to us.

Depending on how you deal with us, we collect:

• Contact and enquiry details— your name, email address, phone number, preferred branch, and the subject and content of messages you send through our contact form, email, phone, or WhatsApp.
• Inspection bookings— your name, email, phone number, the estate and date you choose, the number of people attending, and any notes you add.
• Account details— for client and realtor accounts: name, email, phone number, profile photo (optional — in the App you can take one with your camera or choose one from your photos), and a password, which we store only as a one-way hash and never in readable form. We also keep security records such as failed sign-in attempts and password-reset requests.
• Plot subscription details— title, full name, gender, date of birth, marital status, spouse’s name, nationality, country of residence, residential address, city, state and local government area, employer, email and phone number; next-of-kin name, address and phone number; the estate, plot size, plot type, number of plots and payment plan you choose; and the realtor who referred you, if any.
• Buy2Sell investment details— full name, gender, date of birth, nationality, address, email, phone number, the type and number of an identity document you provide (for example NIN, BVN, international passport, driver’s licence or voter’s card), and your investment amount and duration.
• Identity (KYC) documents— photos or scans of identity documents you choose to upload, for example through the App’s camera or photo picker, so we can verify your identity for a subscription, investment or realtor account.
• Payment and transaction records— amounts paid, payment dates, payment references, instalment schedules, receipts, and the documents we generate for you (such as allocation letters, agreements and certificates). We do not collect or store your card details through our Services.
• Realtor details— in addition to account details: date of birth, state, referral code, who recruited you, your bank name, account name and account number (to pay commissions), and your sales and commission history.
• AI chat assistant messages— the questions you type into the chat assistant on the Website or in the App.
• Technical data— your IP address, browser and device type, pages visited, and error diagnostics collected automatically when you use our Services; and, in the App, your device model, operating system and app version, and a push notification token that identifies your device to our notification service (see Our mobile app and Cookies and device storage).

If you give us personal data about someone else — such as your next of kin, spouse, or a person attending an inspection with you — please make sure they know you are sharing it and have seen this policy.

We only process personal data where the NDPA gives us a lawful basis to do so:

• To perform a contract with you, or take steps at your request before entering one— processing plot subscriptions and Buy2Sell investments, recording payments, allocating plots, issuing receipts and title documentation, scheduling inspections, running your client or realtor account, and paying realtor commissions.
• To comply with legal obligations— keeping accounting and tax records, verifying identity where the law requires it, meeting land-registration requirements, and responding to lawful requests from courts, regulators and law enforcement.
• For our legitimate interests, where these are not overridden by your rights — answering enquiries, sending payment reminders and service updates, preventing fraud and securing our systems, improving our Services, and establishing or defending legal claims.
• With your consent— for optional analytics and marketing messages about new estates and offers. You can withdraw consent at any time without affecting processing that took place before you withdrew it.

We send service messages by email and SMS — for example confirmations, payment reminders, receipts and account notifications. We only send marketing messages where the law allows, and every marketing message tells you how to opt out.

The chat assistant on the Website and in the App answers questions using information about our estates, prices and FAQs. The messages you type are sent to our AI service provider to generate a reply. We do not save chat transcripts to our database; the conversation is kept only on your device — on the Website, in your browser until you close the tab.

Please do not enter passwords, identity numbers, bank details or other sensitive information into the chat. The assistant can make mistakes, and nothing it says forms part of any agreement with us — see our Terms of Use.

The App asks for device permissions only when a feature needs them, and you can refuse or later withdraw any permission in your phone’s settings. Refusing a permission only switches off the feature that needs it.

• Camera and photos— used only when you choose to take or pick a profile photo or an identity document to upload. The App does not access your camera or photo library in the background, and only the images you select are uploaded.
• Fingerprint or face unlock— if you turn on biometric sign-in, your phone’s operating system checks your fingerprint or face and only tells the App whether the check passed. Your biometric data stays on your phone; we never receive or store it.
• Push notifications— if you allow notifications, your device receives a push token, which we store with your account so we can send you payment reminders, subscription and investment updates, and account alerts. You can turn notifications off at any time in your phone’s settings.
• Device and diagnostic data— device model, operating system and app version, and crash and error reports, which we use to keep the App working and secure.
• Sign-in tokens— saved on your device to keep you signed in, as described in Cookies and device storage.

The App does not collect your precise location or your contacts, and we do not sell your data or use it for third-party advertising.

We do not sell your personal data. We share it only with:

• Our realtors— the realtor who referred you can see the details needed to follow up on your subscription or investment and earn their commission.
• Service providers who process data on our behalf, under contractual confidentiality and security obligations: website and database hosting; email delivery; SMS delivery; image and document storage; error monitoring; website analytics; and our AI chat provider.
• Professional advisers and land authorities — lawyers, surveyors, auditors, and government land registries where needed to perfect title or meet legal requirements.
• Authorities— courts, regulators and law enforcement where the law requires it, or where needed to protect our rights, our clients or the public.
• A successor business— if we are involved in a merger, acquisition or sale of assets, subject to this policy continuing to protect your data.

Some of our service providers store or process data outside Nigeria, including in the United States and the European Union. Where we transfer personal data outside Nigeria we rely on the transfer mechanisms the NDPA allows — such as the recipient country having adequate protection, appropriate contractual safeguards, or your consent — and we require providers to protect the data to a standard consistent with this policy.

We use a small number of cookies and browser-storage items:

• Strictly necessary sign-in cookies— when you sign in to the client portal or a dashboard, we set a short-lived session cookie (about 15 minutes), a refresh cookie that keeps you signed in for up to 30 days, and a security token that protects your account against cross-site request forgery. The Website’s accounts cannot work without them.
• Session storage— your browser keeps your current chat conversation and whether you have dismissed the site announcement bar. These are cleared when you close the tab.
• App sign-in tokens— when you sign in to the App, your sign-in tokens are saved on your device so you stay signed in. They are removed when you sign out or uninstall the App, and they stop working when they expire or when your account is deleted.
• Analytics cookies— if enabled, Google Analytics sets cookies that help us understand how visitors use the Website in aggregate. The App does not use advertising identifiers and does not show ads.

You can block or delete cookies in your browser settings. If you block the sign-in cookies, you will not be able to use the client portal or dashboards. You can opt out of Google Analytics using Google’s opt-out browser add-on.

We keep personal data only as long as we need it:

• Subscription, investment, payment and title records— for as long as you hold an interest in the property or investment, and afterwards for as long as tax, accounting, land-transaction and limitation laws require.
• Account data— for as long as your account is open, and for a reasonable period after closure to deal with any queries or claims.
• Enquiries and inspection bookings— for as long as needed to deal with the enquiry or follow up on your interest, unless they lead to a subscription or investment.
• Sign-in refresh tokens— deleted automatically when they expire.

When data is no longer needed we delete it or anonymise it so it can no longer identify you.

We use technical and organisational measures to protect personal data, including encrypted connections (HTTPS), hashed passwords, httpOnly sign-in cookies, protection against cross-site request forgery, temporary account lockout after repeated failed sign-in attempts, role-based access so staff see only what their job needs, and rate limiting. No system is completely secure. If a personal data breach is likely to put your rights and freedoms at high risk, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

Under the NDPA you have the right to:

• be informed about how we use your personal data;
• access your personal data and get a copy of it;
• have inaccurate or incomplete data corrected;
• have your data deleted where we no longer have a lawful reason to keep it;
• restrict how we process your data in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive your data in a commonly used, machine-readable format and have it sent to another controller;
• withdraw consent at any time, where we rely on consent;
• not be subject to a decision based solely on automated processing that significantly affects you; and
• complain to the Nigeria Data Protection Commission.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before acting on a request. We will respond within the time the law requires, and we won’t charge you unless a request is manifestly unfounded or excessive. Some rights have limits — for example, we cannot delete records we are legally required to keep.

To delete your account, follow the steps in Deleting your account.

If any of your details change — for example your phone number, address or bank account — please let us know so we can keep our records accurate.

You can delete your client or realtor account at any time, in the App (open your profile and choose Delete account) or by emailing us from the address registered to your account. When we delete your account we remove your profile, sign-in details, profile photo, uploaded identity documents, push notification tokens and, for realtors, your bank details.

We keep records we are legally required to keep — such as subscription, payment, investment, commission and title records — for as long as the law requires, and we keep what we need to honour any subscription or investment that is still active. Full details, including how long each type of record is kept, are on our account deletion page.

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

Our Services link to third-party services such as Google Maps, WhatsApp, YouTube and social media, and the App is distributed through app stores such as Google Play. Their own privacy policies govern how they handle your data, and we are not responsible for their practices.

We may update this policy from time to time. The effective date at the top shows when it last changed. If we make a significant change, we will tell you through our Services or by email before it takes effect.

For any question about this policy or your personal data, or to exercise your rights, contact us at: