1. Who We Are
Gwags.ng is a local discovery and booking platform owned and operated by First Pristine Solutions Ltd, a company incorporated in Nigeria. We help users discover hotels, shortlets, restaurants, events, delivery services, and people in Gwagwalada and across Nigeria.
For the purposes of Nigeria's Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023 (NDPA), First Pristine Solutions Ltd is the Data Controller of personal data collected through Gwags.ng.
Contact our Data Protection Officer:
First Pristine Solutions Ltd, Gwagwalada, Abuja, Nigeria
Email: privacy@gwags.ng
2. Information We Collect
2.1 Information you provide directly
- Account information: email address and password when you create an account.
- People / professional profile: full name, tagline, skills, area, phone number, WhatsApp number, and profile photos — only when you choose to list yourself.
- Booking and order information: name, contact details, dates, number of guests, and any special requests made when booking hotels, shortlets, or placing orders.
- Reviews and ratings: text content and star ratings you submit for businesses or stays.
- Business listings: business name, address, category, description, photos, pricing, and contact details if you register as a vendor or partner.
- Communications: messages you send to our support team.
2.2 Information collected automatically
- Device and usage data: browser type, device type, operating system, pages visited, and time spent — collected via standard server logs.
- Location data: approximate location inferred from your IP address, or precise location if you grant permission in your browser. See Section 7.
2.3 Information from third parties
- Payment processors: we receive a transaction confirmation reference and status from Paystack. We do not receive or store your card number, CVV, or full bank details. See Section 6.
3. How We Use Your Information
- To create and manage your account and authenticate you securely.
- To process bookings, orders, and payments and send you confirmations.
- To display your public profile and skills if you choose to list yourself in the People section.
- To show listings, search results, and personalised recommendations based on your location and browsing.
- To enable vendors and businesses to manage their listings on the platform.
- To send transactional emails (booking confirmations, receipts) and, where you have opted in, promotional communications.
- To investigate and prevent fraud, abuse, and violations of our Terms and Conditions.
- To comply with legal obligations under Nigerian law.
- To improve our platform using aggregated, anonymised analytics.
4. Legal Basis for Processing (NDPR / NDPA)
We process your personal data under the following lawful bases:
- Contract: processing necessary to deliver the services you have requested (account creation, bookings, payments).
- Consent: marketing emails; precise location access; displaying your public profile in the People section. You may withdraw consent at any time.
- Legitimate interests: fraud prevention, platform security, and improving our services — balanced against your rights.
- Legal obligation: where we are required to retain or disclose data under Nigerian law or a court order.
5. How We Share Information
We do not sell your personal data. We share it only in the following circumstances:
- With vendors and service providers: when you make a booking, the relevant hotel, restaurant, or delivery provider receives the details necessary to fulfil your request.
- With infrastructure providers: Supabase (database and authentication, hosted on AWS), Vercel (web hosting). These processors are contractually bound to handle your data in accordance with NDPR requirements.
- With Paystack: payment processing. Paystack is PCI-DSS compliant. Their privacy policy is available at paystack.com/privacy.
- With law enforcement or regulators: where required by a valid legal process, court order, or Nigerian regulatory authority.
- In a business transfer: if First Pristine Solutions Ltd merges with or is acquired by another entity, your data may be transferred. We will notify you beforehand.
6. Payments & Paystack
We do not store your card or bank account details. All payment processing on Gwags.ng is handled by Paystack Technology Inc., a PCI-DSS Level 1 certified payment processor licensed in Nigeria. When you make a payment, you are interacting directly with Paystack's secure payment page or SDK. Gwags.ng receives only a payment reference number and status (success or failure). We never see, transmit, or store your card number, expiry date, CVV, or PIN.
By making a payment on Gwags.ng you also agree to Paystack's Terms of Service and Privacy Policy.
Any payment disputes, charge-backs, or failed transaction queries that relate to Paystack's processing should be raised with Paystack directly. For refund eligibility concerning our own services, see our Refund Policy.
7. Location Data
Gwags.ng may request access to your device's precise GPS location to show you nearby listings, calculate distances, and improve search relevance. This access is:
- Always requested through your browser's permission prompt — we never access location without an explicit browser-level grant from you.
- Optional — the platform works without location permission, though some features (nearby suggestions) will be less accurate.
- Not continuously tracked in the background — location is accessed only when you are actively using the site.
If you list yourself in the People section or add a business, the area or address you manually enter will be stored and displayed publicly on the platform.
8. Data Storage & Security
Your personal data is stored in Supabase (PostgreSQL database hosted on Amazon Web Services infrastructure in the EU West region). Vercel hosts the web application. Both providers maintain high security standards including encryption in transit (TLS) and at rest.
We implement reasonable organisational and technical measures to protect your data. However, no system is completely secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the Nigeria Data Protection Commission (NDPC) as required by the NDPA 2023.
We are not responsible for security failures caused by your own actions — including sharing your password, using an insecure device, or falling victim to phishing attacks outside our platform.
9. Retention Periods
- Account data: retained for the lifetime of your account, plus 12 months after deletion to allow dispute resolution.
- Booking and transaction records: retained for 6 years to comply with Nigerian tax and commercial law.
- Public profile (People section): retained until you request removal or your account is deleted.
- Marketing consent records: retained for 3 years or until you withdraw consent.
- Server logs: retained for 90 days.
10. Your Rights
Under the NDPR and NDPA 2023, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — request that inaccurate data be corrected.
- Erasure — request that your data be deleted, subject to legal retention requirements.
- Object — object to processing based on legitimate interests.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent — at any time, where processing is based on consent.
- Lodge a complaint — with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
To exercise any of these rights, email privacy@gwags.ng. We will respond within 30 days.
11. Children's Privacy
Gwags.ng is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify registered users by email. Your continued use of Gwags.ng after changes take effect constitutes acceptance of the revised policy.