Privacy policy.

KeyVend is operated by Se7en Solutions ("KeyVend," "we," "us"). This Privacy Policy explains how we collect, use, store, and safeguard the personal information of residents and estate staff who use the KeyVend mobile app and admin dashboard — and the rights you have over your data — in line with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR 2019), and other applicable laws.

For any question about this policy or to exercise your rights, contact support@keyvend.app.

We collect the following categories of personal data, depending on how you use KeyVend:

Identity and contact information

Full name, phone number, email address, and a profile photo, collected when you register as a resident.

Residency information

Your estate, street, block, and unit; your Apartment ID; whether you are registered as the Primary or Secondary occupant of your unit; house type; and utility meter number.

Access and security information

Visitor codes you generate (including the visitor's access window and entry/exit type), a 4-digit PIN used to authorize visitor invitations, and — where your estate has connected physical access hardware — records of gate/door access events tied to codes issued through the app. If you register a vehicle, we collect the plate number, make, model, colour, and any access card number linked to it.

Financial information

Your wallet balance and transaction history, service charge and levy payment records, and water token purchase history. Card and bank account details are collected and processed directly by our payment processor, Paystack — KeyVend does not store your full card number or bank credentials on its own servers.

Communications

Messages sent to you by your estate's administrators through KeyVend, and the fact that a visitor code was shared (KeyVend does not read or store the content of messages you send to visitors through WhatsApp, SMS, or other apps via your device's own share function).

Technical information

Standard technical data generated by using the app (device type, app version, and similar diagnostic information) where applicable.

We do not knowingly collect personal data from children. KeyVend accounts are for adult residents of a participating estate.

We process your personal data because it is necessary to provide the service you've signed up for — performing our contract with you as a resident of a KeyVend-enabled estate. Specifically:

• Identity, contact, and residency data: to verify you as a legitimate resident, assign you to your unit, and enable estate administrators to manage occupancy.
• Access and security data: to generate and validate visitor codes, and to support your estate's physical security operations.
• Financial data: to process levy and service charge payments, and water token purchases, and to maintain an accurate record of what you owe and have paid.
• Communications: to deliver messages your estate administrators send to residents.

Where processing isn't strictly necessary to perform our contract with you (for example, optional communications), we rely on your consent, which you may withdraw at any time.

We share personal data only where necessary to provide the service:

• Your estate's administrators, who can see your profile, address assignment, and payment/balance information as part of managing the estate.
• Paystack, our payment processor, to process wallet funding and payments. Paystack's own privacy policy governs how they handle your payment details.
• Our cloud infrastructure providers (including Supabase, our database provider, and email/communication providers used to deliver messages), who process data on our behalf under contract and do not use it for their own purposes.
• Physical access control and utility metering hardware connected by your estate (where applicable), to the extent necessary to operate gate access and water vending.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

Cross-border transfer notice

KeyVend's database infrastructure is currently hosted outside Nigeria (in the European Union). Under the NDPA, transferring personal data outside Nigeria requires appropriate safeguards, which we maintain with our infrastructure providers.

We retain your Resident Data for the duration of your residency and only for the period within which it is reasonably needed and may delete elements of your Personal Data associated with your account. We will normally warn you if your access is going to be withdrawn and give you the opportunity to retain your account.

Under the Nigeria Data Protection Act, you have the right to:

• Be informed about how your data is processed (this policy)
• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data, where we are not required to keep it for a legal or contractual reason
• Object to or request restriction of certain processing
• Receive a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Not be subject to a decision based solely on automated processing that significantly affects you
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, contact privacy@keyvend.app. We will respond without undue delay.

We use industry-standard measures to protect your data, including encrypted connections between the app and our servers, role-based access controls limiting which estate staff can see which data, and an audit log of administrative actions taken on resident records.

We may update this policy as KeyVend's features change. We'll update the date above, and notify residents of material changes through the app.