Who We Are and Scope
Highrachy Investment and Technology Limited (RC 791587) (“Highrachy”, “we”, “us” or “our”) operates https://www.highrachy.com and https://www.blissville.com.ng. Blissville is our residential real estate brand and is not a separate legal entity. This Policy explains how we handle personal data under the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive and other instruments issued by the Nigeria Data Protection Commission (NDPC), and other applicable law.
It applies to visitors to our websites, prospective and existing buyers, investors, joint purchasers, nominees, agents, referral partners, contractors, business contacts, and visitors to our offices, project sites and events. Employees and job applicants receive a separate notice.
We are the data controller for our property sales, investor relations, websites and marketing. Where we provide technology services to a client, we generally act as a processor on the client’s instructions, and the service agreement and the client’s own notice govern that data.
This Policy is a notice. It is not a request for consent. Where the law requires consent, we ask for it separately.
Data We Collect
We collect and process personal data across the following defined categories depending on your engagement with us:
Identity and contact
Name, title, date of birth, nationality, telephone, email, residential and correspondence addresses, and identification details such as NIN, BVN, passport, driver’s licence and tax identification number where needed.
Property and transaction
Enquiries, inspection records, reservations, offers, allocations, payment plans, payments, receipts, survey and title documents, and resale or transfer requests.
Verification and source of funds
Identification documents, proof of address, employment and income evidence, and source of funds information.
Other individuals
Details of joint purchasers, spouses, nominees, next of kin, guarantors, attorneys and beneficiaries.
Business details
Employer, company details and business contacts of corporate buyers, investors, agents, contractors and partners.
Digital and communications
IP address, device and browser data, cookie identifiers, lead form submissions from social media and advertising platforms, WhatsApp, email and telephone enquiries, and call recordings at sales offices.
Site and media
Visitor logs, CCTV, photographs, video and drone footage at our offices, project sites, inspections and events.
Technology services
Account details, usage records and technical logs where we act as controller.
We collect data from you directly, from your representatives, from our agents and referral partners, from lenders and service providers, from advertising platforms and from public registries. We do not seek sensitive personal data such as health, religious or biometric data unless the law requires it or it is necessary for a specific transaction. Identity numbers such as NIN and BVN and copies of ID documents are held with restricted access.
Security & Credential Protection
Please do not send passwords, banking credentials or card security codes (CVV/PIN) to us. Highrachy and Blissville personnel will never ask for your confidential banking or account access credentials.
Why We Use Data and Our Lawful Bases
Under the Nigeria Data Protection Act 2023, every processing activity must be justified by an established lawful basis:
- Contract: handling enquiries, reservations, offers, sale agreements, payments, allocations, title documentation and after sales service.
- Legal obligation: identity verification, anti-money laundering controls, tax, regulatory reporting and record keeping.
- Legitimate interests: managing sales, investor and agent relationships, fraud prevention, security of our sites and systems, monitoring of business communications and records for quality, security and dispute purposes, analytics, improving our services, establishing or defending legal claims, and the business transfers described in Section 7.
- Consent: electronic marketing where the law requires it, optional cookies, and publishing identifiable images or testimonials.
Where you do not provide data, we need to enter or perform a contract or to meet a legal duty, we may be unable to proceed with the transaction. You may withdraw consent at any time without affecting earlier processing.
Anti Money Laundering and Regulatory Reporting
As a real estate developer, we are subject to Nigerian anti money laundering laws. We verify identity and source of funds, keep records, and may report suspicious activity or share information with the Nigerian Financial Intelligence Unit (NFIU), Special Control Unit against Money Laundering (SCUML), the Economic and Financial Crimes Commission (EFCC) and other competent authorities. The law may prohibit us from telling you that a report has been made.
Statutory Retention & Confidentiality
Your rights of access, deletion, restriction and objection do not apply to the extent that we are required by law to retain data or keep a matter confidential.
Joint Purchasers, Nominees and Other Individuals
If you give us personal data about another person, you confirm that you are authorised to do so and that you have told that person about this Policy.
You must keep your contact and identity details current. We are not responsible for consequences arising from inaccurate or outdated information you give us, including missed notices or misdirected communications.
Where property is acquired for a minor, we deal with a parent or legal guardian. Where an interest passes on death or by operation of law, we deal with the successor on proof of authority. We do not otherwise knowingly collect children’s data.
Marketing, Cookies and Advertising
We send property updates, offers, newsletters and event invitations where the law permits, and with your consent where it requires. You can unsubscribe at any time using the link in a message or by contacting us. We keep a minimal record of your choice so we respect it. We will still send service, contractual, security and legally required messages.
Our websites use necessary cookies and, with your consent where required, analytics and advertising technologies, including pixels from [for example Google and Meta]. Advertising platforms may receive limited data about your interactions with us to measure and target advertising. You can manage choices through our cookie banner and your browser settings. Blocking some cookies may affect the websites.
Who We Share Data With
Where necessary and lawful, we share data with:
- Our group companies and project partners;
- Sales agents and referral partners acting for us under written terms. Independent agents who process data on their own account are responsible for that processing, and we are not liable for it;
- Land registries, LASRERA and other state and federal regulators, tax authorities, the NFIU, SCUML, the EFCC, courts and law enforcement;
- Banks, payment providers, mortgage lenders, insurers, escrow agents and trustees;
- Lawyers, surveyors, architects, auditors and other advisers;
- Estate management companies and residents’ associations;
- IT, cloud, CRM, messaging, analytics and advertising providers;
- Contractors, property managers and facilities managers;
- Prospective buyers, investors, lenders and advisers, and successors, in connection with a sale, merger, financing or restructuring of Highrachy or any project.
Non-Monetization Commitment
We do not sell personal data. We take reasonable steps to ensure that providers who process data on our behalf do so under written terms with suitable safeguards.
Transfers Outside Nigeria
Some data is processed outside Nigeria because we use cloud, communication, analytics and advertising providers abroad and because some buyers, investors and agents are based overseas. We transfer data abroad only as the NDPA permits, for example where the destination is recognised as adequate, appropriate safeguards are in place or another lawful basis applies. Using our services may involve such transfers. Details are available on request.
Security and Breaches
We use reasonable technical and organisational measures to protect personal data, including access controls, confidentiality obligations, secure storage and oversight of providers. Access to identity documents and financial records is limited to staff who need it.
If a personal data breach occurs, we will respond under the NDPA, including notifying the NDPC within the time required, which is currently 72 hours, and notifying affected individuals where the law requires. No system is completely secure and we cannot guarantee absolute security. If you suspect your data has been compromised in connection with our services, contact us promptly.
Retention Schedule
We keep personal data only as long as needed for the purposes above, to meet legal duties and to establish or defend claims. Our standard retention periods are:
| Data Category & Purpose | Standard Retention Period |
|---|---|
| Enquiries and leads that do not proceed | Up to two years after last contact |
| Identity verification and anti-money laundering records | At least five years after the relationship ends, or longer where required |
| Sale, payment, allocation and title records | For as long as the interest subsists and for twelve years afterwards |
| CCTV and visitor records | Up to 90 days unless needed for an incident or claim |
| Marketing data | Until you unsubscribe or after two years of inactivity |
| Website and cookie data | No longer than 26 months |
| Technology service records | For the term of the service and six years afterwards |
We delete or anonymise data when it is no longer needed, unless a legal hold or lawful reason requires us to keep it.
Your Rights
Subject to the NDPA and the limits in this Policy, you have enforceable rights over how your personal data is handled:
Right of Access
Request a copy of the personal data we hold about you and verify lawful processing.
Right to Rectification
Require inaccurate, incomplete, or outdated personal details to be promptly updated.
Right to Erasure
Request deletion where data is no longer necessary or retention is no longer legally mandated.
Right to Restriction
Ask us to suspend processing while the accuracy of data or the lawfulness of processing is contested.
Data Portability
Receive your data in a structured, commonly used format or request transfer to another controller.
Right to Object
Stop data use for direct marketing at any time or object based on our legitimate interests.
You may withdraw consent at any time. Where the law gives you the right not to be subject to decisions based solely on automated processing, we will honour it.
To make a request, contact us using the details in Section 12 and put “Data Protection Request” in the subject line. We may ask for information to verify your identity. We will respond within 30 days and may extend that period for complex or numerous requests, with notice to you.
We may refuse or limit a request that is manifestly unfounded or excessive, that would affect the rights of others, that is covered by legal privilege or needed for a legal claim, or where Section 4 or another legal requirement applies. Where we refuse, we will explain why unless the law prevents us.
You may complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng/.
Other Sites, Changes and Contact
Our websites may link to third party sites and social media platforms. They process data under their own policies, which this Policy does not cover.
We may update this Policy from time to time. The current version, with its revised date, will be published on the relevant website. Where the law requires, we will give further notice or seek consent before material changes take effect.
Highrachy Investment and Technology Limited
Designated Data Controller for Highrachy and Blissville
Ibukun House, No. 70 Adetokunbo Ademola Street, Victoria Island, Lagos, Nigeria
