Privacy Notice

This Privacy Notice applies to personal data processed through Vayla’s website at vaylaapp.com, the Vayla partner portal at vendor.vaylaapp.com, our mobile experiences and the support channels we operate (together, the “Platform”).

It covers guests who browse or book on Vayla, businesses and their staff who list with us (“Vendors”), Agents, and anyone who contacts us. It does not cover how a Vendor handles your data in its own systems outside Vayla, such as a hotel’s front-desk register; the Vendor is responsible for that.

We process personal data in line with the Nigeria Data Protection Act 2023 (“NDPA”) and the regulations and guidance issued by the Nigeria Data Protection Commission (“NDPC”). Words such as “personal data”, “processing” and “data controller” have the meanings given in the NDPA.

Please read this notice alongside our Terms and Conditions. If anything here is unclear, contact us using the details at the end of this page.

Vayla Enterprise, trading as Vayla, is the data controller for the personal data described in this notice. We are a business name registered with the Corporate Affairs Commission of Nigeria under registration number 9839764, and our address is House 7, beside Parktonian Hotel, Ikate, Lagos State, Nigeria.

For any privacy question or request, email vayla7217@gmail.com with “Privacy” in the subject line, or call +234 813 655 2541. Our privacy contact handles these requests and oversees how we protect personal data.

We collect only what we need to run the Platform and the bookings you make. Depending on how you use Vayla, this includes:

• Account details

  Your name, email address, phone number, login credentials and, if you add them, a profile photo, gender and address.

• Booking details

  The stay, table, ticket, experience or vehicle you book, dates and times, number of guests, special requests, booking references, cancellations, refunds, reviews you write and listings you save to your wishlist.

• Payment details

  Transaction references, amounts, payment status and the limited payment details our payment provider shares with us. We never receive or store your full card number, CVV or PIN.

• Vendor and business details

  Business name and type, CAC registration details, the identity of owners or representatives (including National Identification Number where provided for verification), contact details, listing descriptions, photos, prices, addresses and map locations, uploaded documents, payout details and the team members a Vendor invites.

• Communications

  Messages sent through Vayla, emails, calls and WhatsApp messages with our support team, complaints and reports about listings.

• Technical data

  IP address, browser and device type, pages requested, dates and times of access and error logs, recorded by our servers and hosting providers to keep the Platform working and secure.

• Preferences

  Your notification choices, and settings stored in your browser such as a collapsed menu.

We do not request access to your device’s precise location (GPS). Locations on Vayla come from what you search for and from the addresses Vendors enter for their listings.

We do not intentionally collect sensitive personal data, such as information about your health, religion, ethnicity or political views. If you choose to include it in a special request, for example an accessibility or dietary need, we use it only to pass the request to the Vendor and fulfil your booking.

Most of the data we hold comes directly from you when you create an account, book, list a business or contact us. We also receive personal data from:

• Vendors, for example when they confirm, update or cancel your booking or respond to a complaint.
• Our payment provider, which confirms whether a payment succeeded and provides the transaction reference.
• A Vendor who invites you to join their team on the partner portal, which gives us your name, email and role.
• Official and public sources we use to verify Vendors, such as the Corporate Affairs Commission register.
• Other guests or Vendors who mention you in a review, message or report.

The NDPA only allows us to process your personal data where we have a lawful basis. The table below sets out what we use your data for and the basis we rely on for each purpose.

• Creating and managing your account, and signing you in securely

  Performance of our contract with you

• Processing bookings, sharing the details a Vendor needs and sending confirmations, reminders and updates

  Performance of a contract

• Taking payments, issuing refunds and handling payment disputes

  Performance of a contract; legal obligation

• Verifying Vendors, their identity and their right to list, and preventing fraud on the Platform

  Legitimate interests in a safe marketplace; legal obligation

• Answering questions, resolving complaints and investigating reports

  Performance of a contract; legitimate interests

• Keeping the Platform secure, detecting misuse and protecting guests, Vendors and staff

  Legitimate interests; legal obligation

• Improving Vayla using summarised information about how features are used

  Legitimate interests

• Sending news, offers and recommendations

  Your consent, which you can withdraw at any time

• Showing browser notifications on your device

  Your consent, given through your browser’s permission prompt

• Keeping accounting and tax records, meeting regulatory requests and establishing or defending legal claims

  Legal obligation; legitimate interests

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations, and we do not rely on them where your interests override ours. You can object to processing based on legitimate interests at any time (see “Your rights”).

If you do not provide data we need to perform a contract, for example your contact details for a booking, we may not be able to complete that booking.

We share personal data only where it is necessary for the purposes above, and only as much as each recipient needs:

• Vendors: when you book, the Vendor receives the details needed to deliver your booking, such as your name, contact details, dates, number of guests and special requests.
• Payment provider: Paystack processes card and bank payments and refunds for bookings made on Vayla.
• Technology providers who host and run the Platform for us, including Vercel (website hosting), Render (application and database hosting) and Amazon Web Services (storage of photos and documents), as well as providers that deliver our emails and messages.
• Map services: listing maps load map images from OpenStreetMap, and addresses entered by Vendors are converted to map coordinates using OpenStreetMap’s Nominatim service. These services receive your IP address when a map loads.
• Professional advisers such as lawyers, accountants and auditors, under a duty of confidentiality.
• Regulators, law enforcement, courts and other public authorities, where the law requires it or where it is necessary to protect someone’s safety or rights.
• A buyer or successor, if Vayla’s business is reorganised, merged or sold, subject to this notice.
• Anyone else, with your consent.

Our service providers may only use your data to provide their services to us, under written terms that require them to protect it.

We do not sell your personal data, and we do not share it with advertising networks or data brokers.

A Vendor that receives your booking details uses them to deliver the booking, for example to check you in, hold your table or hand over a vehicle. The Vendor decides how it keeps those details in its own systems and is responsible for complying with the NDPA when it does so.

Our Terms require Vendors to use customer information only for authorised purposes, such as delivering the booking it was shared for, and to protect it. If you believe a Vendor has misused your data, tell us and we will investigate.

Some of our technology providers store or process data on servers outside Nigeria, for example in the United States or the European Union. When personal data leaves Nigeria, we make sure the transfer is permitted under Part VIII of the NDPA: either the destination provides an adequate level of protection, or the transfer is covered by appropriate safeguards such as binding contractual terms, or another lawful basis applies, such as the transfer being necessary to perform a contract with you.

You can ask us for more information about the safeguards we use for a particular transfer.

We keep personal data only for as long as we need it for the purpose it was collected for, including to meet legal, accounting and reporting requirements. As a guide:

• Account details

  While your account is open, and for up to 12 months after it is closed so we can deal with any follow-up questions

• Booking, payment and refund records

  Six years after the transaction, to meet tax and accounting requirements

• Vendor verification and business records

  For as long as the Vendor lists with us, and six years afterwards

• Support conversations, complaints and reports

  Up to three years after the matter is resolved

• Marketing preferences

  Until you unsubscribe; we then keep a minimal record so we do not contact you again

• Server and security logs

  Up to 12 months

• Data stored in your browser

  Until you sign out, clear your browser data, or it expires

We may keep data for longer where the law requires it or where it is needed for a legal claim or investigation. When data is no longer needed, we delete it or anonymise it so that it can no longer identify you.

Vayla uses only the cookies and browser storage needed to make the Platform work. We do not use advertising cookies, and we do not use analytics or tracking tools that follow you across other websites.

• vayla_web_at

  What it doesKeeps you signed in on vaylaapp.com. It cannot be read by scripts on the page.

  How long it lasts7 days, or until you sign out

• vayla_web_email

  What it doesRemembers the email you signed in with so your account page can show it. It cannot be read by scripts on the page.

  How long it lasts7 days, or until you sign out

• vayla_vendor_at and vayla_vendor_email

  What it doesThe same sign-in cookies for the partner portal at vendor.vaylaapp.com.

  How long it lasts7 days, or until you sign out

• Browser storage

  What it doesRemembers your wishlist, the email you last signed in with, profile details you entered, unfinished listing drafts on the partner portal, and settings such as notifications and a collapsed menu.

  How long it lastsUntil you clear it in your browser or sign out

Because these are strictly necessary for features you ask for, they do not require your consent. If we ever introduce optional cookies, such as analytics, we will ask for your consent first and let you change your choice at any time.

You can block or delete cookies in your browser settings, but if you block the sign-in cookies you will not be able to stay signed in.

We use technical and organisational measures appropriate to the risk, including:

• Encrypting data in transit using HTTPS across the Platform.
• Keeping sign-in tokens in secure cookies that page scripts cannot read, with separate sign-in sessions for the guest site, partner portal and admin console.
• Limiting access to personal data to staff and service providers who need it, with administrator tools restricted to approved accounts.
• Uploading photos and documents straight to secure storage through short-lived upload links.
• Requiring Vendors and service providers to keep the data they receive confidential and secure.

No online service can be completely secure. Please use a strong password that you do not use elsewhere, keep your login details private and tell us immediately if you suspect someone has accessed your account. We will never ask for your password, card PIN or online banking password.

If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it, as the NDPA requires, and we will tell you without undue delay where the breach is likely to result in a high risk to you, with advice on steps you can take.

The NDPA gives you the following rights over your personal data:

• To be informed about how your data is used, which is what this notice is for.
• To access your data and receive a copy of it.
• To have inaccurate or incomplete data corrected.
• To have your data deleted where we no longer have a lawful reason to keep it.
• To restrict our use of your data, for example while a complaint about its accuracy is checked.
• To receive data you provided in a structured, commonly used, machine-readable format, and to have it sent to another organisation where technically possible.
• To object to processing based on our legitimate interests, and to object at any time to direct marketing.
• To withdraw your consent at any time where we rely on it. This does not affect processing that already took place.
• Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you.
• To complain to the Nigeria Data Protection Commission.

To exercise a right, email vayla7217@gmail.com with “Privacy request” in the subject line, or contact us using the details below. We may ask you to confirm your identity before acting on a request, so that we never disclose your data to someone else.

We do not charge for requests unless they are clearly unfounded or excessive. We will respond without undue delay and normally within 30 days. If a request is complex, we will tell you if we need more time and why.

You can update most account details yourself from your profile on Vayla.

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Decisions such as approving a Vendor or restricting an account are reviewed by a person. If this changes, we will update this notice and tell you about your rights before it applies to you.

We send marketing messages, such as offers and new experiences, only if you have agreed to receive them. Every marketing email includes a way to unsubscribe, and you can also unsubscribe by contacting us.

Service messages, such as booking confirmations, payment receipts, security alerts and important changes to our terms, are not marketing. We will still send these while you have an account or an active booking.

Vayla is only for people aged 18 or over, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it. A booking made for a family may include the names or number of children travelling; that information is provided by the adult making the booking and used only to deliver it.

Vayla links to services run by others, such as our Facebook and Instagram pages and our WhatsApp support line. When you use them, the operator of that service, for example Meta for WhatsApp, processes your data under its own privacy policy, which we encourage you to read.

We will update this notice when our services, our providers or the law change. The date at the top of this page shows when it was last updated. If we make a significant change, such as using your data for a new purpose, we will tell you by email or on the Platform before it takes effect and ask for your consent where the law requires it.

If you are unhappy with how we have handled your personal data, please contact us first at vayla7217@gmail.com so we can try to put it right.

You also have the right to complain to the Nigeria Data Protection Commission, the authority that enforces the NDPA. You can find its contact details at ndpc.gov.ng.