NDPR Compliance
Nigeria Data Protection Regulation (2019) & Nigeria Data Protection Act (2023)
Our Commitment
Kraiga Limited is committed to protecting the personal data of all users of the MyTenant platform in full compliance with the Nigeria Data Protection Regulation (NDPR) issued by NITDA in 2019 and the Nigeria Data Protection Act (NDPA) 2023.
Lawful Basis for Processing
- Consent — Tenant application form submission constitutes informed consent for data processing related to the tenancy.
- Contractual necessity — Processing agent and tenant data is necessary for providing the property management service.
- Legal obligation — Financial records are retained as required by Nigerian tax law (FIRS).
- Legitimate interest — Platform security, fraud prevention, and service improvement.
Data Processing Activities
| Activity | Data Processed | Lawful Basis | Retention |
|---|---|---|---|
| Agent registration | Name, email, phone, business details | Contractual | Account lifetime |
| Tenant application | Personal info, employment, references, next-of-kin | Consent + Contract | 7 years post-tenancy |
| Identity verification | NIN/BVN/ID number via Dojah | Consent | Verification result retained, raw ID deleted after 90 days |
| Payment processing | Transaction amounts, bank details | Contractual + Legal | 6 years (tax law) |
| Communications | Email/phone for transactional messages | Contractual | Account lifetime |
| Security logging | IP address, login timestamps | Legitimate interest | 12 months |
Data Subject Rights
All users may exercise the following rights by contacting dpo@mytenant.ng:
- Right of access — Request a copy of your personal data. Use the "Data Export" feature in your dashboard or email us.
- Right to rectification — Correct inaccurate data through your profile settings or by contacting us.
- Right to erasure — Request deletion of your data, subject to legal retention requirements.
- Right to restrict processing — Request that we limit how we use your data.
- Right to data portability — Receive your data in a machine-readable format (JSON export).
- Right to object — Object to processing based on legitimate interest.
We will respond to all data subject requests within 30 days.
International Data Transfers
Some service providers (Brevo for email, Cloudinary for document storage) may process data outside Nigeria. Where this occurs, we ensure adequate safeguards are in place through standard contractual clauses or equivalent measures as required by the NDPR.
Data Breach Notification
In the event of a data breach that poses a risk to data subjects, we will notify the National Information Technology Development Agency (NITDA) within 72 hours and affected individuals without undue delay, as required by the NDPR.
Data Protection Officer
Kraiga Limited — Data Protection Officer
Email: dpo@mytenant.ng
9A Tayo Olukoya Close, Ojodu Estate, Lagos, Nigeria
NITDA Registration: In progress