Privacy Policy

Renly Technologies (“Renly”, “we”) provides software that estate managers use to run residential estates and gated communities. This notice explains what personal data we handle, why, and what rights you have under the Nigeria Data Protection Act 2023 (NDPA).

Who controls your data

For most data in Renly, the estate or managing company is the data controller and Renly is a data processor acting on their instructions. If you are a resident and want your data corrected or erased, contact your estate management first; we will act on their instruction. For our own website and account records, Renly is the controller.

What we collect

• Account details, name, phone number, email address, and for staff a password hash and, if enabled, a multi-factor secret. Passwords are never stored in readable form.
• Residency records, the unit you occupy, your role (owner, tenant, landlord, dependant, domestic staff) and the dates that relationship starts and ends.
• Billing records, service charges and levies raised against your unit, payments received, and the reference returned by the payment provider. We never see or store your full card number. Card details are handled entirely by Paystack or Flutterwave.
• Visitor and gate records, visitor passes you create (visitor name, optional phone, vehicle plate, validity window) and entry or exit events recorded at the gate, including the time, the direction and whether entry was allowed.
• Maintenance records, issues you report, any photographs you attach, and the messages exchanged about them.
• Device details, a push notification token, platform and app version, so we can deliver notifications you have asked for.
• Technical logs. IP address, request time and error diagnostics, kept for security and troubleshooting.

What we do not do

• We do not sell personal data. Ever.
• We do not use your data to build advertising profiles.
• We do not put personal data into product analytics. Analytics events carry opaque identifiers and describe behaviour, never who you are, which unit you live in, or who visited you.

Why we handle it

• To perform a contract, collecting service charges, issuing visitor passes, handling maintenance.
• Legitimate interests, estate security, fraud prevention, and keeping the service reliable.
• Consent, optional communications, which you can withdraw at any time.
• Legal obligation, financial records we are required to retain.

Who we share it with

We use a small number of processors, each for a defined purpose:

• Paystack, Flutterwave, payment processing.
• Google (Firebase Cloud Messaging), push notification delivery.
• Termii. SMS one-time codes and alerts.
• Meta (WhatsApp Business), notifications where you have opted into that channel.
• Cloud hosting and object storage, running the service and storing uploaded files.

We share data with your estate’s management because that is the point of the service. We do not share it with other estates: each estate’s data is isolated from every other estate’s at the database level.

Transfers outside Nigeria

Some of our processors, notably push notification and messaging providers, operate outside Nigeria, so certain data is transferred abroad. Where that happens we rely on contractual safeguards with those providers as permitted by the NDPA.

How long we keep it

• Financial records, retained while you occupy a unit and for six years afterwards, to meet record-keeping obligations and resolve disputes.
• Gate and visitor logs, retained for 24 months, then deleted. These records exist for estate security and are not kept indefinitely.
• Maintenance records, retained for 24 months after closure.
• One-time codes, expire within minutes and are stored only as a hash.
• Account records, deleted or anonymised within 90 days of your estate closing its account, subject to the retention periods above.

Your rights

Under the NDPA you may ask to:

• access the personal data we hold about you;
• correct anything inaccurate;
• have data erased, where we have no overriding obligation to keep it;
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw consent for optional communications.

Write to hello@renly.ng. We respond within 30 days. You also have the right to complain to the Nigeria Data Protection Commission.

Security

Passwords and shift PINs are hashed with Argon2id. Traffic is encrypted in transit. Each estate’s data is isolated at the database level, so a fault in one part of the system cannot expose another estate’s records. Access to production data is limited to staff who need it. No system is perfectly secure, and we will notify you and the Commission of any breach that meets the NDPA threshold.

Children

Renly is not intended for children under 18. Where a resident registers a dependant, that record is entered and controlled by the responsible adult.

Changes

We will post any change here and update the date above. Material changes will be notified in the app.

Contact

Renly Technologies
Lagos, Nigeria
hello@renly.ng