Privacy Policy & Data Processing Notice
LEGAL & REGULATORY PREAMBLE: InabPrivé is an ultra-luxury asset marketplace and concierge advisory product owned and operated by Inab Realty Ltd, a private limited liability company incorporated under the laws of the Federal Republic of Nigeria, with its registered corporate office situated in Lagos, Nigeria ("Inab Realty", "Company", "we", "us", or "our"). We are committed to safeguarding the confidentiality, privacy, and personal data of our distinguished clientele, private family offices, institutional investors, and luxury asset vendors.
1. Regulatory Governance and Controller Identity
Inab Realty Ltd operates as the primary Data Controller responsible for your personal information processed through the InabPrivé platform (accessible at inabprive.com, test.inabrealty.com, mobile interfaces, and private advisory channels).
Our data protection protocols and governance frameworks strictly adhere to:
- The Nigeria Data Protection Act 2023 (NDPA) and directives issued by the Nigeria Data Protection Commission (NDPC);
- The General Data Protection Regulation (EU) 2016/679 (EU GDPR) and the UK Data Protection Act 2018 (UK GDPR);
- The California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA);
- Applicable international anti-money laundering and know-your-customer (AML/KYC) statutory retention requirements.
2. Categories of Personal Data We Collect
Due to the ultra-high capitalization and regulatory rigor demanded by multi-million-dollar real estate acquisitions, supercars, yachts, and aircraft, we collect specific, proportionate personal data:
A. Direct Client Identification & KYC Data
- Identity Records: Full legal name, title, date of birth, place of birth, nationality, government-issued photo identification (international passport, national ID card, diplomatic credentials, or driver's license).
- Biometric & Verification Data: Live facial verification capture and identity document verification imagery processed via secure, certified identity validation partners.
- Corporate & Mandate Credentials: Certified corporate incorporation files, Memorandum and Articles of Association, board resolutions, power of attorney documents, and Ultimate Beneficial Ownership (UBO) declarations for corporate entities, trusts, and family offices.
B. Financial, Liquidity & Escrow Information
- Proof of Funds (POF): Bank comfort letters, certified bank statements, asset portfolio documentation, or institutional custody confirmations verifying acquisition liquidity.
- Transaction & Escrow Data: Escrow account routing, payment confirmations, source-of-wealth declarations, and statutory receipts.
C. Contact & Advisory Profile Data
- Contact Details: Personal and business email addresses, primary and encrypted telephone numbers, physical residential and registered corporate addresses.
- Acquisition Preferences: Bespoke criteria, architectural interests, maritime specifications, aviation range requirements, and private client advisory notes.
D. Technical, Device & Interaction Telemetry
- Device Telemetry: Internet Protocol (IP) address, browser version, operating system, device hardware identifiers, and language configurations.
- Interaction Logs: Timestamped session logs, listing views, catalog downloads, saved favorites, and concierge inquiry history.
3. Lawful Bases for Data Processing
We process personal data strictly in accordance with recognized lawful bases under Section 25 of the Nigeria Data Protection Act 2023 and Article 6 of the GDPR:
- Contractual Performance: Processing required to onboard clients, facilitate asset inquiries, execute bilateral introduction mandates, coordinate escrow instructions, and deliver white-glove concierge services.
- Statutory and Regulatory Compliance: Fulfilling mandatory AML/CFT due diligence under the Money Laundering (Prevention and Prohibition) Act 2022, reporting to the Special Control Unit against Money Laundering (SCUML), NFIU, and tax authorities.
- Legitimate Interests: Safeguarding platform cybersecurity, preventing fraudulent proof-of-funds submissions, protecting proprietary seller relationships, managing legal risk, and ensuring non-circumvention.
- Explicit Consent: Where required by law, we obtain affirmative consent for direct marketing dispatches, non-essential cookies, and specialized biometric identity verifications.
4. How We Share and Disclose Your Information
Inab Realty Ltd treats client information with the highest degree of discretion. We do not sell, rent, commercialize, or trade your personal data. Disclosures are strictly limited to the following:
- Certified Escrow Agents and Financial Institutions: Regulated banking entities and designated escrow agents managing deposit custody and transactional settlement.
- Conveyancing Counsel and Title Notaries: Qualified real estate attorneys, aviation title registries, and maritime classification societies necessary to draft and close legal conveyances.
- Identity Verification & Security Partners: Specialized SOC-2/ISO-certified AML and biometric verification providers (e.g., licensed identity validation services) under strict data processing agreements.
- Regulatory Authorities & Law Enforcement: Statutory disclosures to the Nigeria Data Protection Commission (NDPC), the Nigerian Financial Intelligence Unit (NFIU), the Special Control Unit against Money Laundering (SCUML), or international judicial bodies pursuant to lawful court orders, subpoenas, or statutory reporting obligations.
- Corporate Restructuring: In the event of a merger, acquisition, corporate reorganization, or sale of company assets, client records may be transferred to the successor entity under confidentiality standards no less protective than this Policy.
5. International Cross-Border Data Transfers
Given the global nature of luxury real estate, international yacht chartering, and cross-border client engagements, your personal data may be transferred to and processed in countries outside Nigeria, including the United Kingdom, the European Union, the United States, and the United Arab Emirates.
Where cross-border transfers occur, Inab Realty Ltd ensures legal compliance through:
- Transferring to jurisdictions officially recognized by the NDPC or European Commission as providing an adequate level of data protection;
- Executing approved Standard Contractual Clauses (SCCs) or Binding Corporate Rules with third-party service providers;
- Relying on specific statutory derogations under Section 43 of the NDPA 2023, including where transfer is strictly necessary for the execution or performance of a high-value acquisition contract entered into in your interest.
6. Data Security and Confidentiality Architecture
Inab Realty Ltd implements robust technical, organizational, and physical security measures:
- Cryptographic Standards: End-to-end TLS 1.3 transport encryption for all web communications and AES-256 encryption at rest for database repositories and document stores.
- Access Governance: Strict Principle of Least Privilege (PoLP) and Role-Based Access Control (RBAC), requiring Multi-Factor Authentication (MFA) for all administrative and concierge systems.
- Security Auditing: Routine vulnerability assessments, penetration testing, continuous security event monitoring, and third-party infrastructure compliance audits.
7. Statutory Data Retention Periods
We retain personal information only for the period necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is mandated or permitted by law:
- AML / KYC Documentation: Retained for a mandatory minimum of five (5) years following the termination of the business relationship or completion of the transaction, pursuant to Section 8 of the Money Laundering (Prevention and Prohibition) Act 2022 and FATF recommendations.
- Transactional and Contract Records: Retained for six (6) years following contract completion in accordance with Nigerian statutes of limitation and statutory tax audit periods.
- General Inquiries and Advisory Records: Retained for two (2) years from the last active client interaction, unless converted into an active advisory mandate.
- Technical Logs: Retained for a rolling period of twelve (12) months for cybersecurity forensics and platform optimization.
8. Your Legal Rights as a Data Subject
Under the Nigeria Data Protection Act 2023, EU/UK GDPR, and applicable global privacy statutes, you possess the following enforceable rights:
- Right of Access: The right to obtain confirmation as to whether your personal data is processed, and to receive a copy of your records alongside processing details.
- Right to Rectification: The right to demand correction of inaccurate, incomplete, or outdated personal information.
- Right to Erasure ("Right to Be Forgotten"): The right to request deletion of your personal data where continued processing lacks a lawful basis (subject to overriding statutory AML/CFT record-keeping mandates).
- Right to Restriction of Processing: The right to restrict the scope of data processing during pending rectification disputes or unlawful processing inquiries.
- Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
- Right to Object: The right to object at any time to processing based on legitimate interests or direct marketing outreach.
- Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, submit a formal request to our Data Protection Officer at dpo@inabprive.com. We will respond within thirty (30) days in accordance with statutory guidelines.
9. Supervisory Authority and Complaints
If you believe that your personal data has been handled in contravention of applicable data protection laws, you possess the legal right to lodge a formal complaint with the relevant supervisory authority:
- Nigeria: Nigeria Data Protection Commission (NDPC) — Website: ndpc.gov.ng | Email: info@ndpc.gov.ng
- United Kingdom: Information Commissioner's Office (ICO) — Website: ico.org.uk
- European Union: The data protection authority of the EU Member State in which you reside.
10. Data Protection Officer (DPO) Contact Details
For inquiries, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact our dedicated Data Protection Officer:
- Data Controller: Inab Realty Ltd (Product: InabPrivé)
- Data Protection Officer: Data Privacy & Regulatory Compliance Directorate
- Email: dpo@inabprive.com
- Corporate Legal Address: Lagos, Nigeria
- General Privacy Enquiries: privacy@inabrealty.com
