Privacy Policy

1. Who this covers

This policy explains how Cribly (“we”, “us”) handles personal data in connection with the Cribly platform. It applies to property owners, agencies and their staff, to tenants and applicants who use the tenant portal or apply through the marketplace, to vendors and maintainers, and to visitors to our public pages.

It sits alongside our Terms of Service. Read the Terms of Service.

2. Who is responsible for your data

This is the most important section of this policy, because the answer is not the same for everyone.

Where the landlord or agency is responsible

When a Principal or agency records a tenancy — a tenant’s name, contact details, identity documents, rent, arrears, maintenance history — that organisation decides why and how the data is used. Under the NDPA they are the data controller and we act as their data processor, handling the data on their instructions to run the Service.

If you are a tenant or an applicant and you want data corrected or deleted, your landlord or managing agency is the right first port of call: they control the record. We will help them act on your request, and we will pass your request on if you send it to us instead.

Where we are responsible

For the accounts we issue, our billing and subscription records, security and audit logs, support conversations, and how the Service itself is used, we are the data controller and this policy is our own notice to you.

3. What we collect

Some of this is sensitive personal data under the NDPA — financial information and identity numbers in particular. We handle it only where there is a lawful basis to do so, and we do not use it for advertising.

4. Where it comes from

• From you, when you register, complete a profile, apply for a unit, or contact us.
• From your landlord, managing agency or their staff, who enter tenancy records into the Service.
• From payment providers, who confirm to us whether a payment succeeded and how it settled.
• From identity, credit and open-banking providers, where a check has been lawfully run.
• Automatically, from your use of the Service — the technical and audit records above.

5. Why we use it, and our lawful basis

6. Who we share it with

We share personal data only where it is needed for the purposes above:

• Your landlord, agency or their authorised staff — for the tenancy they manage. Staff access is limited by the permissions the account holder sets, and by the properties they are assigned to.
• Payment service providers — licensed operators who process card, transfer and direct-debit payments and report the outcome back to the Service.
• Verification and credit providers — where a check has been lawfully requested.
• Communications providers — email, SMS and messaging partners who deliver notifications on our behalf.
• Infrastructure and support suppliers — hosting, storage, backup, error monitoring and analytics, under contract and only to run the Service.
• Professional advisers, insurers and auditors — where they need it and are bound by confidentiality.
• Authorities — where the law requires it, or to establish, exercise or defend legal claims.
• A buyer or successor — if the business is sold or reorganised, subject to this policy continuing to apply.

We do not sell personal data, and we do not share it for third-party advertising. A current list of the processors we use is available on request.

7. Transfers outside Nigeria

Some of our suppliers — hosting, email and error monitoring in particular — process data outside Nigeria. Where that happens we rely on the transfer conditions permitted by the NDPA, and we require the recipient by contract to protect the data to the standard set out in this policy.

8. How long we keep it

• Tenancy records, agreements, invoices and payment records are kept for as long as the landlord or agency needs them, and then for the period the law requires financial records to be retained — generally at least six years from the end of the relevant financial year.
• Account data is kept while the account is open. After closure we delete or anonymise it, except where we must keep records to meet a legal obligation or defend a claim.
• Verification results are kept only as long as needed for the decision they informed, and the audit record of that decision.
• Security and audit logs are kept for a limited period appropriate to detecting and investigating misuse.

9. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• be told how your personal data is used — which is what this policy is for;
• ask for a copy of the personal data held about you;
• have inaccurate data corrected and incomplete data completed;
• ask for data to be deleted, where there is no lawful reason to keep it;
• ask us to restrict how data is used while a dispute about it is resolved;
• receive data you gave us in a portable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent you have given, without affecting anything done before you withdrew it;
• not be subject to a decision with legal effects taken solely by automated means. Screening scores in the Service are advisory and are shown to a person who decides — they do not decide anything on their own.

Tenants can exercise several of these directly from the privacy centre in the tenant portal — reviewing consent, choosing communication channels, exporting a copy of their data and requesting deletion. For everything else, or if you are not a tenant, write to privacy@cribly.ng and we will respond within the time the NDPA allows.

Because your landlord or agency controls the tenancy record itself, a request about that record may need their decision. We will tell you when that is the case rather than leaving you waiting.

10. How we protect it

We encrypt data in transit, store passwords hashed rather than readable, restrict access to those who need it, separate each organisation’s data, and keep audit records of changes to important records. We take backups and test that they restore.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission and, where required, you — without undue delay.

You have a part in this too: use a strong, unique password, do not share your login, and tell us promptly if you think your account has been accessed by someone else.

11. Cookies

We use a small number of cookies:

• Essential — keeping you signed in and protecting forms against cross-site request forgery. The Service cannot work without these.
• Preference — remembering choices such as your language.
• Measurement — where used, understanding which pages are used so we can improve them. These are not used to build advertising profiles.

You can clear or block cookies in your browser, but blocking essential cookies will stop you signing in.

12. Children

The Service is not intended for children, and accounts are for people aged 18 or over. Where a tenancy record includes details of a minor living in the household, that data is entered by the landlord or agency and should be limited to what is genuinely necessary. Tell us if you believe a child’s data has been collected inappropriately and we will remove it.

13. Changes

We will update this policy as the Service and the law change. Where a change materially affects you we will give notice by email or in the Service before it takes effect. The date at the top of this page is the version in force.

14. Contact and complaints

Privacy questions and data-subject requests: privacy@cribly.ng
Cribly

If you are not satisfied with how we have handled your request, you can complain to the Nigeria Data Protection Commission (NDPC). Complaining to us first is usually quicker, but it is not a precondition.