Privacy notice
What personal data 34orients Ltd handles, why, who it is shared with, and what you can ask us to do with it. Written to be read, not to be survived.
1. Who we are
NiroStay is a product of 34orients Ltd, a company incorporated in the United Kingdom with offices in the UK and Nigeria. In this notice, "we", "us" and "34orients" mean 34orients Ltd.
For privacy questions, or to exercise a right described below, write to [email protected] or to 34orients Ltd, 48 Brocks Terrace, Porth, United Kingdom, marked for the attention of the Privacy Contact. We aim to respond within 30 days.
2. Two roles, and why the difference matters
Data protection law distinguishes the party that decides why data is used (the controller) from the party that uses it on someone else's instructions (the processor). We act in both roles:
- As controller for our own business: the marketing site, walkthrough requests, account and billing records for the organisation that subscribes, and our service logs.
- As processor for the guest, reservation and folio data a property enters into the platform. The property decides what is collected and why; we host and process it to provide the service. Our processing terms are in the subscription agreement and the data processing addendum that comes with it.
3. What we collect
| Category | Examples | Who it is about |
|---|---|---|
| Account and team | Name, email, phone, role, hashed password, organisation, property access | Owners and staff |
| Organisation | Property names and addresses, unit counts, rate plans, branding, custom hostname, plan and billing contacts | Owners and staff |
| Guest and stay | Guest name, email, phone, stay dates, unit, charges, payments, refunds, enquiries and message threads | Guests, entered by the property or the guest |
| Payment | Gateway reference, amount, currency, status, provider settlement data. Card numbers are entered at the provider and never reach us. | Guests and the property |
| Technical | IP address, browser and device details, request logs, correlation ids, timestamps, error traces | Anyone using the service |
| Communications | Messages you send us, walkthrough requests, and the emails we send (with delivery status) | Prospects, staff, guests |
We do not knowingly collect special-category data (such as health or religious information) and ask that you do not put it into free-text fields. If a guest's accessibility needs are recorded so a stay can be delivered, treat that as sensitive and use the minimum necessary.
4. Why we use it, and our lawful basis
| Purpose | Lawful basis under the NDPA |
|---|---|
| Providing the platform: reservations, folios, guest pages, email | Performance of a contract with the subscribing organisation; for guest data, the property's instructions as controller |
| Creating and securing accounts, invitations, password resets | Performance of a contract; legitimate interests in keeping accounts secure |
| Billing, invoices, tax and accounting | Performance of a contract; compliance with legal obligations |
| Support and responding to a walkthrough request | Legitimate interests; consent where you have asked us to contact you |
| Preventing fraud, abuse and unauthorised access | Legitimate interests; legal obligations |
| Improving the product using aggregated, de-identified usage | Legitimate interests, with no attempt to re-identify individuals |
Where we rely on legitimate interests, we have considered whether a person would reasonably expect the use and whether a less intrusive option exists. You can object to that processing at any time.
5. Cookies and local storage
The marketing pages do not set advertising cookies or run third-party analytics. They load the Inter typeface from Google Fonts, which means your browser contacts Google's servers and Google receives your IP address. If you prefer not to make that request, block the font in your browser; the pages remain readable in a system font.
The staff console stores a session token and small interface preferences (such as the last property you filtered by) in your browser's local storage. That storage is required for the console to work and is cleared when you sign out or clear site data.
6. Who we share it with
We do not sell personal data and we do not give it to advertisers. We share it only where the service needs another party:
- Payment providers, such as Paystack, when a guest pays online or a property connects a merchant account. The provider processes the card data and returns a reference and status.
- Email providers, such as Resend or Postmark, which deliver invitations, password resets, booking confirmations, receipts and enquiry replies, and report delivery status back to us.
- Channel management, such as Channex, when a property connects OTA distribution. Only the inventory, rates and booking data needed for that connection are shared.
- Hosting and infrastructure providers that run the database and application for the deployment.
- Professional advisers and authorities, where required by law, a court order, or to establish or defend a legal claim.
Each provider is bound by its own terms and, where it handles personal data for us, by a data processing agreement. A current list of subprocessors is available on request from [email protected].
7. Where data is processed
Some providers process data outside Nigeria. Where that happens, we rely on the transfer safeguards available under the NDPA — including contractual protections and a documented assessment of the destination — and we will tell a subscribing organisation which region its deployment sits in. Ask us before signing if a specific location is a requirement.
8. How long we keep it
- Account and organisation data: for as long as the subscription is active, then up to 90 days to allow export and reactivation.
- Guest, reservation and folio data: for as long as the property's account is active, then the export window. Financial records may be kept longer where Nigerian tax and company law requires it.
- Email delivery logs: up to 12 months, so a delivery failure can still be investigated.
- Server logs: up to 90 days, unless preserved for a security investigation.
- Sales and walkthrough correspondence: up to 24 months from the last contact.
When a retention period ends, data is deleted or irreversibly anonymised. Backup copies expire on the schedule agreed for the deployment.
9. How we protect it
Passwords are hashed, sessions are short-lived and rotate, every request is scoped to an organisation, merchant gateway secrets are encrypted, and sensitive actions are audit-logged. The security page sets out the controls and, just as importantly, what we do not yet claim. No system is perfectly secure; if we become aware of a breach affecting personal data, we will notify the affected organisation and the Nigeria Data Protection Commission as required by the NDPA.
10. Your rights
Under the Nigeria Data Protection Act 2023 you have the right to:
- be informed about how your data is used;
- access the personal data we hold about you;
- correct data that is inaccurate or incomplete;
- request deletion where there is no lawful reason to keep it;
- restrict or object to certain processing;
- receive your data in a portable, machine-readable form;
- withdraw consent where processing is based on consent, without affecting processing already carried out;
- complain to the Nigeria Data Protection Commission.
Send a request to [email protected]. We may ask you to verify your identity, and we will respond within 30 days. If your request concerns a stay, we will forward it to the property and support them in answering it.
11. Children
The platform is for businesses and is not intended for use by anyone under 18. A booking may include children, in which case the adult making the booking provides their details. We do not create separate accounts for children or use their data for marketing.
12. Automated decisions
We do not make decisions with legal or similarly significant effects about you by automated means alone. Booking confirmations, payment verification and fraud checks are rule-based operational steps, and a person at the property can always override an operational decision about a stay.
13. Changes to this notice
We update this notice when the way we handle data changes. Material changes will be announced on this page and, where we have your address and the change affects you, by email. The date at the top always says which version you are reading.
14. Contact
34orients Ltd · 48 Brocks Terrace, Porth, United Kingdom
UK: 07586215433 · Nigeria: 08168628163
Privacy: [email protected]
Security: [email protected]
General: [email protected]
Web: 34orients.com
If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission or, in the UK, to the Information Commissioner's Office.